A Faronics Deploy phishing attack campaign has been abusing the legitimate cloud-based endpoint management platform to silently enrol victim machines into attacker-controlled deployments, then use that foothold to push ConnectWise ScreenConnect as a secondary remote-access channel. Huntress, a managed detection and response (MDR) company, observed the activity running from 21 July to 20 August, during which Faronics-themed lures reached more than 457 endpoints via emails disguised as invoices, tax documents, or other routine business files.
How the Faronics Deploy phishing attack actually works
Faronics Deploy is a cloud-based platform that allows IT administrators to remotely enrol and manage computers, deploy software, and execute scripts, which is precisely what makes it attractive to abuse. The phishing emails carry embedded links leading to a profiling website that assesses whether the visitor is a real target or a security researcher. If the site detects an analysis environment, it activates a decoy routine, such as displaying a generic error message, and stops there.
A genuine victim, by contrast, is walked through a download flow that delivers a legitimate, signed Faronics Deploy installer. The file is disguised as an Adobe document, a reader application, or a plugin update, and is frequently named Adobe.exe. Running it does nothing obviously suspicious: the machine is simply enrolled in a Faronics deployment the attackers already control.
From that point, no further user interaction is needed. The threat actor uses Faronics’ own remote-deployment functionality to push PowerShell scripts to the enrolled machine. Those scripts pull down additional tools from attacker-controlled infrastructure or external locations, including GitHub. The end result is the installation of ConnectWise ScreenConnect, giving the attackers a second remote-access channel that operates independently of Faronics.
Huntress notes that delivery methods varied between scripts: some used curl or mshta to retrieve content, while others invoked msiexec to install payloads hosted on attacker-controlled servers. ‘These scripts are subsequently used to install ScreenConnect, establishing an additional remote access mechanism on the compromised endpoint,’ Huntress says.
ScreenConnect as redundancy, not just a bonus
The dual-channel setup is deliberate. ScreenConnect gives attackers hands-on interactive control better suited to active intrusion than Faronics’ deployment model. It also acts as a fallback: if defenders identify and terminate the malicious Faronics deployment, or remove its agent, the ScreenConnect session remains live. That kind of redundancy is a clear sign the threat actors behind this campaign understood they might be burned on the first vector.
The campaign did not rely solely on the Faronics lure either. Huntress detected a separate social engineering incident on 20 August in which a user was manipulated into executing Quick Assist, a built-in Windows remote support tool with a documented history of abuse in tech-support scams. Then, on 24 August, Huntress researchers found a case in which a victim searching for a Geek Squad refund form was instead convinced into downloading and running a rogue ScreenConnect client that connected back to an attacker-controlled domain, borertors92.anondns[.]net. In late August, Huntress’s Security Operations Centre issued three critical incident reports covering what appeared to be malicious ScreenConnect installations and unexpected process execution across separate organisations, with all three seemingly involving additional remote monitoring and management (RMM) solutions.
Faronics responds; defenders get detection advice
Huntress notified Faronics of its findings on 5 August, and the vendor confirmed the malicious activity. Faronics implemented additional anti-abuse measures and contacted affected organisations directly to flag the potential compromise. Malicious activity dropped significantly from 21 August, which Huntress attributes to Faronics’ intervention.
For defenders trying to assess exposure, Huntress recommends checking C:\ProgramData\Faronics\Logs\ for a ScriptRunner.log file, which may preserve the names of remotely executed scripts and the download URLs they used. The ck parameter in Faronics configuration requests is also flagged as an indicator of compromise: it identifies the associated customer deployment and can help trace compromised endpoints or malicious accounts. Any ScreenConnect installation in an environment where it is not normally deployed should be treated as suspect.
The broader takeaway sits in the numbers. Huntress’s Blue Report 2026, drawn from 338 million simulations run in customer production environments, found that once attackers are operating with valid credentials, only 37% of their subsequent actions are blocked, a reminder that prevention scores measured at the perimeter tell only part of the story.
