Fake HR Clients Trap Payroll Staff

Cybercriminals are currently impersonating major US HR and payroll platforms with sophisticated phishing tactics. These threat actors are creating fake landing pages using services like Lovable to mimic legitimate brands, but with a crucial difference: they offer a non-existent desktop client. This deception makes it difficult for users to identify the scam, as there is no legitimate version to compare it against.

Victims are directed to download an executable from GitHub Releases, a platform commonly used by developers. This downloaded file is not inherently malicious, allowing it to bypass most security measures. It is a variant of ScreenConnect, a legitimate remote IT support tool. However, this version is configured for surreptitious, unattended remote access, disabling all user-facing indicators like warning banners or system tray icons.

The campaign shows around 291 downloads, though the actual number of victims is likely lower. The primary target appears to be payroll staff, with the ultimate goal of diverting company funds through unauthorized wire transfers. Security researchers advise companies to verify the legitimacy of any desktop clients offered by their HR and payroll vendors and to educate employees about these threats.