Hackers abuse Faronics Deploy admin tool to install ScreenConnect
Hackers exploit Faronics Deploy to install ScreenConnect on victim endpoints.
Threat actors are abusing the legitimate Faronics Deploy endpoint management tool to gain remote administrative control over victim computers. Phishing emails with Faronics-themed lures are used to trick users into downloading a malicious Faronics installer, which enrolls their machine into an attacker-controlled deployment. The attackers then use Faronics' remote deployment features to execute scripts that install ConnectWise ScreenConnect, establishing a persistent remote access channel.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Faronics?
Get an email when a new story names Faronics, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors exploited user trust in a legitimate endpoint management platform (Faronics Deploy) by crafting convincing phishing lures that tricked users into enrolling their machines into an attacker-controlled deployment environment. Once enrolled, the attackers leveraged the tool's own trusted administrative features to silently install ConnectWise ScreenConnect, establishing persistent remote access that blends in with normal IT operations. This attack is particularly dangerous because it weaponizes legitimate software, making it harder for security tools and analysts to flag the activity as malicious. It highlights the critical gap between end-user awareness of phishing tactics and the catastrophic access an attacker can gain by abusing trusted administrative tooling.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ScreenConnect