Fake payroll desktop apps used to gain remote access to company systems

Cybersecurity researchers at Allure Security have identified a campaign where attackers use fake desktop applications to impersonate three major US-based payroll and HR platforms. These platforms currently only offer web-based interfaces and mobile companion apps, meaning the advertised desktop software is entirely fraudulent.

When targeted employees, such as payroll or HR clerks, install the fake software, it silently installs ScreenConnect, a legitimate remote access tool from ConnectWise. This allows attackers to gain persistent, unauthorized control over the victim's computer, creating a pathway to divert or drain company payroll funds.

The attackers utilized several sophisticated methods to obscure their activities. The fraudulent websites were created using the AI app builder Lovable and hosted on Vercel, hidden behind bot-challenge screens to prevent automated security scanners from indexing the sites. The malicious installers were hosted on GitHub, leveraging the platform's trusted domain to avoid suspicion.