Cybercriminals are impersonating three US HR and payroll providers with fake Windows desktop applications designed to trick HR staff into granting persistent remote access to their computers. The campaign matters because it targets employees handling highly sensitive personal, benefits and payroll information, while using legitimate services and software to avoid appearing malicious.

The fake websites are hosted on Vercel and the downloads on GitHub, while the installer displays a genuine Microsoft .NET installation window before silently deploying ConnectWise ScreenConnect. The remote-management tool is configured for unattended access, runs at startup and hides warning indicators; downloads across the three campaigns totalled 291, although the actual number of victims is unknown. Allure Security advises checking whether HR vendors genuinely offer desktop apps and warning relevant staff.