Phishing crews hijacked a legitimate IT tool to take over more than 450 computers
Attackers pushed fake Adobe files that quietly enrolled victim PCs into Faronics Deploy, then used it to install ScreenConnect for hands-on remote control.
Key points
- Huntress tracked phishing emails abusing Faronics Deploy, a legitimate IT management tool, that reached more than 457 endpoints between July 21 and August 20, 2026.
- Victims were tricked into running a signed Faronics installer disguised as an Adobe download, which enrolled their PC into an attacker-controlled deployment.
- The attackers then pushed PowerShell scripts through Faronics to install ConnectWise ScreenConnect as a second remote-access channel.
- Faronics was notified on August 5, added anti-abuse controls, and malicious activity dropped sharply from August 21.
- Defenders should check
C:\ProgramData\Faronics\Logs\ScriptRunner.logand look for unexpected ScreenConnect installs.
A phishing campaign has been quietly turning a legitimate IT admin tool against the people it was built to help. The attackers used Faronics Deploy, a cloud service that lets IT teams manage company PCs from a browser, to take over victim machines and plant a second remote-control tool on top.
Huntress, a managed detection and response firm, first reported the activity via BleepingComputer. They tracked the campaign between July 21 and August 20, 2026, and counted more than 457 affected endpoints. It's a pattern we've watched develop: our 4 August story on the Smoke#Screen campaign showed attackers abusing ScreenConnect the same way, and that story is now one of eight ScreenConnect-related pieces we've published since July.
The lures were familiar: emails dressed as invoices or tax documents.
How did the attack actually work?
Victims clicked a link, landed on a site that fingerprinted their machine, and were prompted to download what looked like an Adobe reader or plugin update. The file was a real, signed Faronics Deploy installer, often renamed Adobe.exe.
If the visitor appeared to be a security researcher coming from a sandboxed analysis environment, the site showed a harmless error instead. Everyone else got walked through the fake download.
Running the installer enrolled the computer into a Faronics deployment the attackers controlled. From there they could push PowerShell scripts, a Windows automation tool IT teams use routinely, without the user clicking anything else.
Those scripts fetched additional tools from attacker infrastructure or GitHub using curl, mshta, or msiexec. The end goal was ConnectWise ScreenConnect, another legitimate remote-support product. If a defender spots the rogue Faronics agent and removes it, ScreenConnect keeps the attackers inside. That's redundancy by design, not accident.
What did Faronics do about it?
Huntress told Faronics on August 5, 2026. The vendor confirmed the abuse, rolled out anti-abuse controls, and began contacting organisations that appeared to have been enrolled without consent. Malicious activity dropped sharply from August 21, which suggests the mitigations worked.
Timeline and indicators
| Date | Event |
|---|---|
| Jul 21, 2026 | Campaign activity begins |
| Aug 5, 2026 | Huntress notifies Faronics |
| Aug 20, 2026 | 457+ endpoints reached with lures |
| Aug 21, 2026 | Malicious activity drops sharply |
What should IT teams check right now?
Start with the logs. Huntress points to C:\ProgramData\Faronics\Logs\ScriptRunner.log, which can preserve the names and URLs of scripts run through the platform. The ck parameter in Faronics configuration requests identifies which customer deployment a machine belongs to and can flag endpoints tied to a rogue account.
Hunt for ScreenConnect installs in environments where your team never deployed it. That's a strong signal.
Should ordinary users worry?
Not directly, but the lesson holds. Don't run an installer that arrived by email or appeared on a web page asking you to update Adobe. Real Adobe updates come from inside the application itself.
