GoKawiilAttackers exploit Faronics Deploy tool to plant ScreenConnect remote access
Huntress researchers found phishing campaigns that trick victims into running a disguised but legitimate Faronics Deploy installer, often labeled as an Adobe file, which secretly enrolls their machine into an attacker-controlled management console. From there, attackers run PowerShell scripts to fetch additional tools and install ConnectWise ScreenConnect, giving them persistent remote access. Over 457 endpoints were targeted between July 21 and August 20 using fake invoice and tax-document lures.
GoKawiil's interpretation of the reporting above, not reported fact.
By abusing signed, legitimate IT management software rather than custom malware, attackers can bypass security tools that trust known vendors, making detection far harder. This case shows how dual-use administrative platforms can be weaponized to silently seize control of enterprise endpoints at scale.
- Phishing emails disguised as invoices led victims to install a legitimate but attacker-controlled Faronics Deploy agent.
- The tool was used to run PowerShell scripts that installed ConnectWise ScreenConnect for persistent remote access.
- Abuse of trusted, signed software makes this attack harder to detect than typical malware campaigns.
Yubico YubiKey 5C NFC Security Key — Phishing campaigns like this one start with a convincing email and a fake download page, and hardware-backed sign-in is one of the strongest defenses against credential theft. The YubiKey 5C NFC plugs into USB-C or taps on a phone for phishing-resistant logins across major accounts and password managers. It's a pocket-sized upgrade for anyone tired of relying on codes that can be tricked out of them.
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-01
Published there as: “Hackers abuse Faronics Deploy admin tool to install ScreenConnect”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.