Researchers at Huntress have identified an active phishing campaign impersonating Bank of America that culminates in the covert installation of a remote monitoring and management (RMM) tool, giving attackers persistent, hard-to-detect access to victims’ Windows machines.
The campaign was flagged after a message landed in one of Huntress’s spamtrap accounts on 28 July, sent from a spoofed address designed to resemble a legitimate Bank of America domain. The email uses a familiar social-engineering hook: a time-limited warning urging the recipient to “confirm” their account details or risk restrictions being placed on it.
Device-dependent payloads
According to Huntress’s analysis, the phishing infrastructure fingerprints the visiting device and serves different content accordingly. Mac users, or anyone with a non-Windows user agent, are shown a conventional credential-harvesting page that also solicits full mailing addresses, government ID numbers, Social Security numbers, and card payment details. Windows users are instead prompted to download and run “Account Guard,” described on the fake page as protection software, but which is in fact a Trojanised installer for ScreenConnect, a legitimate RMM tool frequently abused by threat actors.
Layered obfuscation and a UAC bypass
The downloaded archive contains a Visual Basic Script that kicks off a lengthy decoding chain, with base64-encoded payloads nested inside one another across several stages before a final PowerShell script is executed. That script retrieves a 17MB ScreenConnect installer from a public file-sharing site and decrypts two AES-128-CBC-protected data blobs bundled within it.
One blob decodes to C# source that Huntress says appears to have been lifted directly from a public GitHub proof-of-concept. It exploits the ICMLuaUtil Elevated COM interface, a known User Account Control (UAC) bypass technique mapped to MITRE ATT&CK T1548.002, allowing the ScreenConnect installer to run with Administrator privileges without ever triggering the UAC prompt users are trained to notice.
The second blob decodes to a VBScript that deletes the registry key pointing to the installer and applies Security Descriptor Definition Language (SDDL) strings and access control lists that prevent the service, installed under the disguised name “Windows Security”, from being viewed, disabled, or removed, even by administrators. The compromised host then reaches out to a command-and-control address in the United Arab Emirates over port 8041/tcp.
Detection and mitigation
Huntress notes that the campaign is detectable at its earliest stage: neither the sending domain nor the embedded redirect link points to Bank of America’s genuine infrastructure, a discrepancy visible in the browser address bar before any file is downloaded. The firm has published full indicators of compromise, including the malicious domains, the C2 IP address, and file hashes, to its GitHub repository, and recommends organisations monitor for unauthorised ScreenConnect installations and unusual SDDL/ACL modifications on endpoint services.
The findings add to a growing body of evidence that RMM abuse remains a preferred technique for threat actors seeking persistent access while evading traditional malware detection, particularly when paired with brand-impersonation phishing that mimics a target company’s visual identity closely enough to pass casual inspection.
