"The simplest way to mitigate an attack like this is to pay close attention to where an email comes from, and where any links point,” Huntress said.
Huntress' discovery and timeline
Cybersecurity firm Huntress received the malicious messages in a honeytrap account on July 28 and traced a campaign that impersonated Bank of America end-to-end — from an email to a lookalike webpage. The phishing pieces copied the bank’s visual style, layout and branding, but the links and domains in the messages pointed to sites controlled by the attacker rather than any legitimate Bank of America domain.
The multi-stage infection chain
Victims who followed the prompts were shepherded into a multi-stage download and execution sequence. The apparent “Security Centre” link delivered a file named AccountGuardSetup.zip. That archive contained a Visual Basic script, AccountGuardSetup.vbs. When executed, the .vbs file began a layered decode process: large Base64-encoded blobs unpacked further scripts, eventually producing a PowerShell payload. That final script downloaded a 17MB Base64-encoded installer from UploadToURL.com, decoded it, and wrote a ScreenConnect MSI package to the victim’s system.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble →Device-dependent behavior: Windows installs, Macs prompted for data
Huntress found the attack was tailored by the visitor’s device. Mac users were not served an install payload; instead they were prompted to submit valuable personal information. Windows users were prompted to download and install an “Account Guard” utility described on the page as “a powerful tool designed to protect your financial data, prevent unauthorized transactions and other cyber threats.” Clicking “Update My Information” delivered the malicious zip that started the installation chain.
How the attacker installs and hides ScreenConnect
Once the multi-stage scripts completed, they installed ScreenConnect RMM on the Windows target. The attacker used a C# script that invokes the ICMLuaUtil COM interface to perform a UAC bypass and silently elevate privileges. Post-installation steps included disguising ScreenConnect as a service called “Windows Security,” removing visible traces of installation, and using Windows permissions to hide related files and services and to prevent normal uninstallation. The deployed ScreenConnect client then awaited remote commands.
Network indicators and infrastructure
When the ScreenConnect instance checked in it connected to a suspected command-and-control server at 217.60.195[.]167 over TCP port 8041. That IP address geolocates to the United Arab Emirates and, Huntress noted, is reputationally challenged — several other malware families have been observed using the same address as a C2. The phishing messages did not point to Bank of America’s legitimate domain; instead the emails referenced bkofamerica[.]com, linked to kleinschnitg[.]com, which opened a page on sectioncompil[.]com from which the malicious zip was served.
What this means for technologists, security teams, and end users
- Technologists and security teams: Huntress’ analysis highlights the need to monitor and block specific IOCs in this chain — for example the domains bkofamerica[.]com, kleinschnitg[.]com, sectioncompil[.]com, UploadToURL.com, and the IP 217.60.195[.]167 over TCP/8041 — and to inspect Base64-heavy scripts and staged installers that conceal payloads inside multiple decode layers.
- Enterprises and procurement leaders: The campaign demonstrates an attacker preference for delivering remote-access tooling via social engineering; procurement and endpoint controls should account for unsigned or masquerading installers that present as helpful utilities like “Account Guard” or “Windows Security.”
- End users and the public: The simplest mitigation, per Huntress, remains attention to message origin and link destinations — the emails in this campaign used lookalike domains rather than Bank of America’s legitimate domains and prompted downloads that led to remote-access installation.
The operation Huntress documented is compact but covert: a single spear of social engineering that unfolds into a layered installer, a UAC bypass, and a remote-access implant that hides as a system service and calls home to a reputationally challenged UAE IP. The concrete question left by the record is operational as much as technical — will defenders block the specific domains and the IP address Huntress identified before additional victims execute the same layered download-and-install sequence?
Original reporting: https://www.infosecurity-magazine.com/news/fake-bank-of-america-phishing-scam/
