Phishing crews hijacked a legitimate IT tool to take over more than 450 computers

Key points

• Huntress tracked phishing emails abusing Faronics Deploy, a legitimate IT management tool, that reached more than 457 endpoints between July 21 and August 20, 2025.
• Victims were tricked into running a signed Faronics installer disguised as an Adobe download, which enrolled their PC into an attacker-controlled deployment.
• The attackers then pushed PowerShell scripts through Faronics to install ConnectWise ScreenConnect as a second remote-access channel.
• Faronics was notified on August 5, added anti-abuse controls, and malicious activity dropped sharply from August 21.
• Defenders should check C:\ProgramData\Faronics\Logs\ScriptRunner.log and look for unexpected ScreenConnect installs.

A phishing campaign has been quietly turning a legitimate IT admin tool against the people it was built to help. The attackers used Faronics Deploy, a cloud service that lets IT teams manage company PCs from a browser, to take over victim machines and plant a second remote-control tool on top.

Researchers at Huntress, a managed detection and response firm (a company that watches customer networks for intrusions), first reported the activity via BleepingComputer. They tracked the campaign between July 21 and August 20, 2025, and counted more than 457 affected endpoints.

The lures were the usual bait: emails dressed up as invoices, tax paperwork, or other routine business files.

How did the attack actually work?

Victims clicked a link, landed on a site that fingerprinted their machine, and were prompted to download what looked like an Adobe reader or plugin update. The file was actually a real, signed Faronics Deploy installer, often renamed Adobe.exe.

If the visitor looked like a security researcher (for example, coming from a sandbox used to safely detonate malware), the site showed a harmless error instead. Everyone else got walked through the fake download.

Running the installer enrolled the computer into a Faronics deployment the attackers controlled. From there, the criminals could push PowerShell scripts to the machine without the user clicking anything else. PowerShell is a scripting tool built into Windows that IT admins use for automation, and attackers love it for the same reason.

Those scripts pulled down more tools, sometimes using curl or mshta to fetch files, sometimes using msiexec to install packages hosted on attacker infrastructure or GitHub. The end goal was to install ConnectWise ScreenConnect, another legitimate remote-support product.

Why install a second remote tool? Redundancy. If a defender spots the rogue Faronics agent and rips it out, ScreenConnect keeps the attackers in the door.

What did Faronics do about it?

Huntress told Faronics on August 5, 2025. The vendor confirmed the abuse, added anti-abuse controls, and started contacting organisations that appeared to have been enrolled without consent. Huntress says malicious activity dropped off sharply from August 21, which suggests the mitigations bit.

Timeline and indicators

What should IT teams check right now?

Start with the logs. Huntress points to C:\ProgramData\Faronics\Logs\ScriptRunner.log, which can preserve the names and URLs of any scripts run through the platform. The ck parameter in Faronics configuration requests identifies which customer deployment a machine belongs to, so it can help spot endpoints tied to a rogue account.

Also hunt for ScreenConnect installs in places where your team never deploys it. That is a strong signal something is off.

Should ordinary users worry?

Probably not directly, but the lesson is worth carrying. If a document you were not expecting asks you to install an Adobe update or a viewer, do not run it. Real Adobe updates come from inside the Adobe application itself, not from an email attachment or a random web page.