Phishing actors exploited the legitimate Faronics Deploy endpoint management platform to enroll victims’ devices in an environment controlled by the attackers, then remotely execute PowerShell scripts and install the ConnectWise ScreenConnect support and access software. According to information reported by Huntress and relayed by BleepingComputer, the lures reached more than 457 endpoints between July 21 and August 20, 2026.
How Did the Operation Unfold?
The campaign began with emails masquerading as invoices, tax documents, or other business files, using lures associated with the Faronics name. The embedded links led to a website that identified the visitor’s characteristics and guided them through a malicious download process. However, when the site was opened from an analysis environment, it displayed a deceptive routine, such as an error message, in an attempt to evade detection.
The victim was asked to download and run a legitimate, digitally signed Faronics Deploy installer, but it was disguised as an Adobe document, reader application, or plug-in update. In some cases, the file was named Adobe.exe. After it was run, the computer was enrolled in a Faronics deployment controlled by the attackers, allowing them to use the remote deployment function to execute PowerShell without further user interaction.
The scripts used multiple methods to retrieve additional tools from the attackers’ infrastructure or from external sites such as GitHub. Examples included using curl or mshta to download content, while msiexec was used in other cases to install payloads hosted on infrastructure controlled by the attackers.
Why Does This Matter?
The scenario does not rely on unknown software or a tool originally designed for attacks; instead, it uses a legitimate management platform with extensive privileges on devices. As a result, subsequent operations may appear to be routine administrative activity, while the installation of ScreenConnect adds an interactive access channel independent of Faronics. This channel gives attackers a backup method if defenders discover the malicious deployment process or remove the Faronics agent.
The most important practical takeaway for IT teams is that removing the first tool may not necessarily be enough to close the breach. They should check whether ScreenConnect is installed on devices where it is not normally used and review management-tool logs for unexpected executions or downloads.
Faronics Actions and Inspection Indicators
Huntress notified Faronics of the findings on August 5, and the company confirmed the observed activity and said it had implemented additional measures to limit abuse. It also contacted potentially affected organizations. Huntress stated that malicious activity declined significantly beginning August 21, indicating the impact of those measures, without proving that all cases of compromise had disappeared.
Huntress recommends that administrators inspect the C:\ProgramData\Faronics\Logs\ path for the ScriptRunner.log file, which may retain the names of remotely executed scripts and download URLs. The ck parameter in Faronics configuration requests may also help identify the associated deployment process and thereby detect suspicious endpoints or accounts. Reviewing the presence of ScreenConnect outside its normal use remains an independent step that should be performed.