Fake payroll desktop apps hand attackers a route to company paychecks

Allure Security uncovered an operation distributing bogus “desktop apps” for three major US payroll and HR platforms, none of which actually offers a desktop client. Victims who ran the installer unknowingly got ConnectWise's ScreenConnect remote-access tool silently deployed alongside a legitimate Microsoft .NET Desktop Runtime 8.0.26 setup, giving the attacker unattended, hidden control of the machine — a particularly dangerous outcome for anyone handling company payroll. The lure pages were built with the AI tool Lovable, hosted on Vercel behind a bot-blocking screen, and linked to installers hosted on GitHub, with all payloads connecting back to a single ScreenConnect server in Germany. Researchers tied the campaign to one operator, noted an August precursor signed with a now-revoked certificate under the name "Dennis Miller," and found the infrastructure has since been taken down, while urging employees to treat any unofficial vendor download as a red flag rather than an upgrade.