"The [ScreenConnect] access mode is set to unattended," Allure notes.
Allure Security's discovery and the scope of the campaign
On Thursday, cybersecurity firm Allure Security published a report describing a campaign that weaponizes fake Windows desktop clients to grant operators persistent remote access to HR and payroll staff machines. Allure said the campaign impersonates three unnamed US-based HR and payroll platforms by offering desktop clients those vendors do not actually provide. The true number of victims is unknown: Allure recorded a total of 291 GitHub download counts across the three fake downloads, but that tally includes downloads by Allure’s own researchers and possibly other researchers and sandboxes, and therefore cannot be treated as a victim count.
The installation chain attackers rely on
Allure lays out a multi-stage ruse that blends legitimate tooling and hosting to avoid easy detection. Victims click through to a convincing site built with the AI app builder Lovable and hosted on Vercel; the site is hidden behind the cloud host’s bot challenge page so web scrapers have not readily indexed it. The downloads themselves are hosted on a GitHub Releases page, giving them the appearance of coming from a trusted domain.
When the downloaded package runs, it presents an authentic Microsoft installer sequence. The installer installs the Microsoft .NET Desktop Runtime 8.0.26 and shows a completed installation, yet no desktop application window appears — leaving the user wondering where their new client went. Behind that visible step, the same installer runs a quiet, no-interface installer that places ConnectWise’s legitimate ScreenConnect remote-management client on the machine.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageHow ScreenConnect is configured in these incidents
According to Allure, the ScreenConnect client is deployed with settings designed specifically to minimize victim awareness. "The victim-facing indicators are turned off: no ‘your machine is being controlled’ banner, no system-tray icon, no connection balloon," Allure wrote. The access mode is set to unattended, the silent install is configured to launch on boot, and the client is set to remain connected across various user sessions — creating "a quiet, persistent, interactive foothold," Allure said.
Allure emphasized that every component in the chain is, on its face, legitimate software and services: the site generator, the host, the GitHub distribution, the Microsoft runtime, and the ScreenConnect RMM product. "Nothing in this chain is malware in the usual sense," the infosec outfit wrote; rather, the threat comes from legitimate remote management technology being procured and installed by people who should not have granted it.
Why HR and payroll staff are the campaign's focus
Allure notes the campaign specifically targets HR and payroll personnel by impersonating desktop clients for HR and payroll platforms that do not offer them. In each of the three cases Allure examined, the vendors do not provide a Windows desktop client — a mismatch that is a key giveaway but one an unaware HR or payroll clerk might miss. Allure warned that such staff, if tricked by promises of superior performance, could inadvertently expose highly sensitive employee information, benefits records, and payroll data to an operator with unattended remote access.
What this means for HR teams, security teams, and procurement
- HR teams: Verify directly with each payroll or HR vendor whether a desktop client exists before downloading or running any software that claims to be a native app. If the vendor does not offer a desktop client, treat any such offer as fraudulent and alert your security team.
- Security teams: Look for the specific operational pattern Allure described — GitHub Releases as the delivery mechanism, installers that surface Microsoft .NET Desktop Runtime 8.0.26, and ScreenConnect installations configured for unattended access with no victim indicators, set to launch on boot and persist across sessions. Because the campaign uses legitimate tooling and hosting, detection will require operational checks against vendor offerings and careful auditing of endpoints.
- Procurement and vendor-risk teams: Reinforce procurement rules that channel all client software through approved vendor channels and validate third-party claims about enhanced desktop clients before approving downloads for line-of-business staff.
The campaign documented by Allure is a reminder that attackers increasingly weaponize legitimate services and software to slip past automated defenders and human scrutiny. With downloads delivered from GitHub, pages built by a legitimate AI builder and served by Vercel, and a Microsoft installer presented to the user, the deception is engineered to look ordinary at every step. The narrow but high-value target set — HR and payroll clerks whose systems hold sensitive employee and financial data — raises a direct and practical question for defenders: before checking indicators of compromise, confirm whether your vendors even offer the desktop clients being advertised.
