As reported by BleepingComputer, a phishing campaign observed between July 21 and August 20, 2026, abused Faronics Deploy — a legitimate cloud-based endpoint management platform — to silently enroll victim machines into attacker-controlled deployments and subsequently install ConnectWise ScreenConnect as a secondary remote access channel. Huntress researchers tracked the activity across more than 457 endpoints before Faronics implemented countermeasures in late August.
Why This Campaign Is Notable
This attack exemplifies a growing and dangerous pattern: threat actors weaponizing signed, legitimate IT administration tools rather than deploying custom malware. The Faronics Deploy installer is digitally signed by the vendor, meaning traditional application control and allow-listing defenses — which often trust publisher signatures — would not flag it as suspicious. The binary is genuine; the intent behind its execution is not.
The attack chain is particularly elegant from an adversary's perspective:
The decision to install ScreenConnect alongside Faronics is strategically sound from the attacker's viewpoint: it provides a hands-on interactive access channel that is independent of the Faronics deployment. If defenders discover and terminate the malicious Faronics enrollment, ScreenConnect remains as a persistent fallback. This redundancy model is something we expect to see replicated in future campaigns abusing other RMM and endpoint management platforms.
Broader Implications: The RMM Abuse Trend
The fundamental problem is not that Faronics Deploy or ScreenConnect are flawed — it is that legitimate remote management tools are inherently dual-use, and attackers are increasingly exploiting this property rather than writing custom malware.
This campaign fits within a broader trend documented across the threat intelligence community. Over the past several years, threat actors — including both cybercriminal groups and nation-state operators — have increasingly abused legitimate remote monitoring and management (RMM) tools such as ScreenConnect, AnyDesk, TeamViewer, Atera, and NinjaRMM to maintain persistence and perform interactive operations on compromised endpoints. The appeal is obvious: these tools are trusted by EDR solutions, generate less telemetry than custom implants, and are already installed in many enterprise environments.
Faronics Deploy adds a new dimension to this pattern because it is not merely a remote access tool — it is an endpoint management platform with the ability to deploy software and execute scripts across enrolled machines. This makes it functionally equivalent to a lightweight MDM/EMM solution for Windows endpoints, and its abuse effectively grants attackers the same capabilities as a rogue IT administrator.
What Defenders Should Be Watching
The detection challenge here is significant because every step of the attack chain involves legitimate software performing legitimate functions. Defenders cannot simply block Faronics Deploy or ScreenConnect — many organizations use these tools legitimately. Instead, detection must focus on behavioral anomalies:
- Unexpected enrollment events — Faronics Deploy agents appearing on machines not managed by the organization's legitimate Faronics deployment
- New Faronics tenant identifiers — endpoints communicating with Faronics cloud infrastructure using tenant IDs that do not match the organization's known deployments
- Renamed signed binaries — executables with Faronics code signatures but filenames like 'Adobe.exe', 'reader.exe', or 'plugin_update.exe'
- PowerShell execution originating from Faronics Deploy processes — especially scripts using curl, mshta, or msiexec to retrieve external content
- Unexpected ScreenConnect installations — particularly when initiated by non-IT personnel or outside of change management windows
- Outbound connections to GitHub or unfamiliar infrastructure from Faronics Deploy service processes
Shield53 Recommendations
Immediate Actions
- Audit Faronics Deploy deployments — Inventory all endpoints running Faronics agents and verify each is enrolled in a legitimate, organization-controlled deployment. Remove any unknown enrollments immediately.
- Review ScreenConnect installations — Enumerate all ScreenConnect instances across the estate and validate that each was installed through approved IT processes.
- Deploy detection rules for the behavioral indicators above — focus on process parent-child relationships where Faronics Deploy spawns PowerShell, curl, mshta, or msiexec.
- Block unknown Faronics tenant enrollment — If Faronics offers tenant-level allow-listing or enrollment controls, enforce them to prevent endpoints from joining unauthorized deployments.
Strategic Hardening
- RMM tool governance — Maintain an authoritative inventory of all remote management and endpoint management tools authorized in your environment. Monitor for any RMM tool not on this list.
- Email filtering for executable attachments — Ensure mail gateway rules flag renamed executables, even when digitally signed. A signed binary named 'Adobe.exe' that is not from Adobe should trigger alerting.
- Application allow-listing review — If your allow-listing strategy trusts publisher signatures (e.g., 'allow anything signed by Faronics'), reconsider whether that trust model is too broad. Consider hash-based or path-based allow-listing for management tools.
- User awareness training — Reinforce that legitimate IT tools are increasingly used as phishing payloads. The presence of a valid code signature does not guarantee that execution is safe or intended.
Faronics' response to this campaign — implementing additional anti-abuse measures and proactively notifying victimized organizations — is commendable and represents the right model for vendor accountability. However, the underlying attack pattern will persist as long as legitimate management tools remain dual-use. Defenders must shift their detection strategies accordingly, moving beyond file-based reputation toward behavioral monitoring of legitimate administrative tooling.
