Cybersecurity researchers at Huntress have uncovered a phishing campaign that abuses Faronics Deploy, a legitimate endpoint management platform used by businesses, schools, and government offices to remotely install software and run scripts across their networks.
According to the security firm, threat actors sent victims phishing emails disguised as invoices, tax documents, financial records, and event invitations. Clicking through led to convincing fake pages, including bogus “document downloading” screens and spoofed Adobe plugin update prompts, that ultimately delivered a genuine, digitally signed Faronics Deploy installer disguised as the expected file.
Once installed, the software enrolled the victim’s device into a Faronics deployment controlled by the attacker, granting them the ability to remotely execute scripts with administrative privileges. Huntress said it repeatedly observed attackers using this access to run PowerShell commands that retrieved additional malicious scripts from external sources, including GitHub, which were then used to install ScreenConnect, a separate remote access tool, on the compromised machine.
Because the initial software was legitimate and properly signed, the activity was able to blend into normal business IT workflows and evade detection by traditional security tools, the researchers said.
Huntress reported observing more than 457 endpoints encountering Faronics-related phishing lures over a one-month period between July 21 and August 20. The company also identified visitor-fingerprinting techniques used to filter out security researchers and mobile users, serving them decoy content, including a fake website impersonating Eastern Bank, instead of the malicious download flow.
Huntress reported the activity to Faronics on August 5. The vendor has since implemented new measures to detect and block fraudulent account registrations, including those using impersonated organisations and compromised accounts, and has proactively contacted customers whose accounts may have been affected. Huntress said it observed a sharp decline in malicious activity involving the platform beginning around August 21.
Researchers noted that key forensic artefacts, including a log file named ScriptRunner.log and a deployment identifier known as the “ck” parameter, can help defenders trace and cluster malicious Faronics activity, even after the original attack scripts are no longer available.
Organisations that discover an unauthorised Faronics installation are advised to isolate the affected endpoint, review the ScriptRunner.log for remotely executed scripts and external URLs, check for secondary remote access tools such as ScreenConnect, and rotate credentials where interactive attacker access is suspected. Huntress said organisations that identify suspected abuse of the platform can report it directly to Faronics support.
Huntress’s full technical writeup, including indicators of compromise, is available at: Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
