Fake payroll desktop apps hand attackers control of the PC

Allure Security found an attacker offering desktop apps for three large US payroll and HR platforms that do not make one. The installer shows a genuine Microsoft installer finishing, while quietly adding ScreenConnect, a legitimate remote access tool, set up for hidden, unattended access. The lure pages were built with Lovable, an AI app builder, and hosted on Vercel.

• Tell whoever runs payroll to install software only from the provider's own website, never from a link or an ad.
• Check your computers for remote access tools you did not install, such as ScreenConnect, and remove them.

Source: Help Net Security. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. The picture is our own graphic. How we source and credit