[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-fake-hr-payroll-desktop-apps-hide-remote-access-malware":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},8362,"fake-hr-payroll-desktop-apps-hide-remote-access-malware","Fake HR Payroll Desktop Apps Hide Remote Access Malware","Attackers built convincing fake desktop clients for cloud-only payroll platforms to trick finance staff into installing a stealthy remote-access tool.","Scammers are inventing desktop apps that do not exist, just to get remote control of your payroll computer.\n\nResearchers at Allure found threat actors impersonating three major US HR and payroll platforms, all of which are normally browser-only services with no desktop client. The attackers used Lovable, a legitimate AI landing-page builder, to spin up convincing fake sites offering a \"desktop app\" download. Clicking through served a modified build of ScreenConnect, a legitimate remote-support tool, hosted on GitHub Releases so it triggers no antivirus flags. That build was configured for unattended access with every victim-facing indicator switched off: no control banner, no tray icon, no connection alert.\n\nThe trick works precisely because there is nothing to compare it to. A real HR platform's desktop app doesn't exist, so victims have no baseline for spotting a fake one. That inverts the usual phishing playbook, where victims can check a login page against the real one. Here, the absence of a legitimate product is the vulnerability, and the payload itself is a clean, unmodified copy of real IT software, not malware in any conventional sense.\n\nGitHub's release page logged 291 downloads, though Allure cautions that figure likely includes researchers and sandboxes, not just victims. The likely targets are finance and payroll staff, and the endgame appears to be wire fraud: unattended access to whoever runs payroll is a direct path to redirecting company payments. Allure's advice is blunt: if your payroll vendor doesn't ship a desktop client, a download claiming to be one is not an upgrade, it's the attack.\n\nThis is less a new malware strain than a new use of an old trick, since ScreenConnect and similar tools have been abused by ransomware crews and scammers for years. What's notable here is the packaging: a slick AI-generated landing page doing the social engineering that used to take a convincing phishing email.","[\"screenconnect\",\"payroll-security\",\"social-engineering\",\"remote-access-trojan\"]","2026-09-29T01:20:00.000Z","2026-09-29T03:21:44.176Z","2026-09-29T03:21:55.751Z","published",null,[],"security",[26,27,28,29],"screenconnect","payroll-security","social-engineering","remote-access-trojan",[31],{"name":32,"url":33},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fhackers-build-fake-desktop-apps-to-trick-victims-into-handing-over-access",0,{"sections":36},[37,42,45,50,55,60,65,70,75,80,85,90,95,100],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",4918,"2026-09-29T05:13:43.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":18},"Security",768,{"name":46,"slug":47,"count":48,"latest_published_at":49},"Policy","policy",406,"2026-09-28T19:04:09.000Z",{"name":51,"slug":52,"count":53,"latest_published_at":54},"Deals","deals",272,"2026-09-28T17:42:46.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Hardware","hardware",191,"2026-09-28T15:45:00.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Science","science",154,"2026-09-28T13:19:18.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Consumer Tech","consumer-tech",139,"2026-09-28T17:09:47.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Software","software",91,"2026-09-25T20:55:00.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Dev Tools","dev-tools",87,"2026-09-28T16:11:42.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",80,"2026-09-28T17:50:28.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"General","general",49,"2026-09-28T16:44:57.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Gaming","gaming",48,"2026-09-25T18:35:21.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]