Hackers Abuse Legitimate IT Management Tool to Sneak Into Business Networks

Cybersecurity researchers at Huntress have uncovered a phishing campaign that abuses Faronics Deploy, a legitimate endpoint management platform used by businesses, schools, and government offices to remotely install software and run scripts across their networks.

According to the security firm, threat actors sent victims phishing emails disguised as invoices, tax documents, financial records, and event invitations. Clicking through led to convincing fake pages, including bogus “document downloading” screens and spoofed Adobe plugin update prompts, that ultimately delivered a genuine, digitally signed Faronics Deploy installer disguised as the expected file.

Once installed, the software enrolled the victim’s device into a Faronics deployment controlled by the attacker, granting them the ability to remotely execute scripts with administrative privileges.