Thecyberwire Fake Desktop Apps Exploit HR Staff for Remote Access
Article Content
- •Attackers impersonate HR software to gain remote access.
- •Over 25 organizations, including a Fortune 500 company, are affected.
- •Malicious downloads are hosted on trusted platforms like GitHub.
A recent cyber campaign has targeted HR departments of multiple organizations, including a Fortune 500 hospitality company and a major US airline, by using fake desktop applications. These apps impersonate legitimate HR and payroll software, tricking employees into installing them. Once executed, the fake app installs ConnectWise's legitimate ScreenConnect software, granting attackers persistent remote access. The campaign exploits the lack of awareness among HR staff, as the impersonated providers do not actually offer desktop applications. The malicious downloads are hosted on a GitHub Releases page, adding to their credibility. Allure Security reported the discovery of this campaign, which has affected over 25 organizations. The exact targeting method remains unclear, but the threat is significant due to the sensitive data that could be exposed.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track FBI in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed… 
Critical Citrix NetScaler Zero-Day Exploitation Confirmed Citrix has confirmed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in its NetScaler ADC and Gateway products, both scoring 9.5 on the CVSS scale. These vulnerabilities are actively exploited in the wild, allowing unauthenticated attackers to execute arbitrary commands and potentially cause…