Cybercriminals Distribute Counterfeit HR Desktop Clients to Gain Stealth Remote Access

Security researchers have uncovered a new scheme in which threat actors distribute bogus desktop applications that masquerade as official HR and payroll tools, aiming to steal credentials and install hidden remote‑access software on corporate computers.

The malicious packages are presented through polished "Lovable" landing pages that closely imitate the look and feel of well‑known U.S. human‑resources and payroll platforms. Victims are enticed to download what appears to be a legitimate client, but the executable is a tampered version of the ScreenConnect remote‑support tool uploaded to a public GitHub repository.

Analysis of the campaign’s infrastructure indicates roughly 291 separate downloads before the malicious repository was taken down. The modest download count suggests a targeted approach, likely focusing on payroll departments where access to employee payment data yields high financial reward for the attackers.

Remote‑access utilities such as ScreenConnect are popular among IT support teams because they allow technicians to view and control a user’s machine without physical presence. By injecting covert code into the installer, the attackers obtain unattended access, enabling them to move laterally across networks, exfiltrate sensitive payroll files, and potentially deploy ransomware.

Cyber‑security firms have warned organizations to verify the source of any HR‑related software before installation, to enforce strict code‑signing policies, and to monitor for unusual outbound connections that may indicate a hidden remote‑access session. Users are also urged to report any unexpected prompts to download desktop clients, especially those linked from unofficial URLs or community repositories.

Law‑enforcement agencies are reportedly investigating the actors behind the operation, and experts predict that similar tactics could reappear as attackers continue to exploit the trust placed in essential business applications. Ongoing vigilance and robust endpoint protection remain critical defenses against this evolving threat vector.