How a Signed Faronics Deploy Installer Gave Hackers Remote Control

Huntress says phishing campaigns used Faronics Deploy to enrol victims’ computers into attacker-controlled management environments. Once the agent was installed with administrative privileges, the operators could remotely execute PowerShell and deploy ScreenConnect without asking the victim to click again.

More than 457 endpoints encountered Faronics-related lures between 21 July and 20 August 2026. That number describes exposure to the campaign, not 457 confirmed compromises. It is still significant because the technique replaces a suspicious malware loader with software that businesses may already recognise and allow.

The victim installed the attacker’s administrator

The phishing emails imitated ordinary business activity, including invoices, tax documents, financial records and invitations. Links led to pages styled as document portals, Adobe downloads or Zoom invitations.

Before showing the next stage, the site collected the visitor’s browser, operating system, screen resolution, timezone, language, touch support and colour depth. Huntress says this information was sent to fileportals.gytgtecg[.]xyz. Mobile visitors and some analysis environments received denial pages or harmless decoys instead of the malicious workflow.

Selected victims were prompted to download executables with names such as AdobeReader.exe, Invoice_89940.exe and DocuSignView.exe. The files were legitimate Faronics Deploy installers carrying a valid digital signature.

Running one did not merely install a local utility. It enrolled the endpoint into a Faronics deployment controlled by the threat actor. The platform then supplied exactly the capability it promises legitimate administrators: central software deployment and remote script execution.

Trusted software completed the attack chain

Huntress repeatedly observed the attackers instructing the Faronics agent to execute PowerShell. Some scripts were retrieved from GitHub with curl or mshta; other paths used msiexec to install packages from attacker-controlled infrastructure.

The next stage was ScreenConnect, another legitimate remote-support product. Installing a second remote-management tool gave the operator durable interactive access and made the activity resemble routine IT administration at several points in the chain.

This is why allowlisting based only on signatures or product reputation is insufficient. A valid signature proves who built a binary. It does not prove who configured its tenant, who issued its commands or whether the installation was authorised for that endpoint.

The user-assisted element also matters. BlackTree previously examined TerminalFix campaigns that persuaded victims to establish the attacker’s tunnel themselves. Faronics abuse follows the same strategic pattern: social engineering crosses the first boundary, then trusted system capability amplifies the result.

The deployment identifier is more useful than the filename

Attackers can rename an installer or generate another package. Huntress highlights a stronger pivot inside the Faronics configuration request: the ck parameter.

Faronics told Huntress that this value identifies a customer or deployment environment. Defenders can use it to group endpoints enrolled into the same unauthorised tenant, while the vendor can use it to investigate the account behind the deployment.

The most useful local artefact is C:ProgramDataFaronicsLogsScriptRunner.log. Even when ordinary PowerShell telemetry is incomplete, this log may preserve remotely executed script names and download URLs, including GitHub repositories used to stage later payloads.

What defenders should investigate

• Search software inventory for unexpected Faronics Deploy and ScreenConnect installations.
• Preserve ScriptRunner.log before removing the agent and review it for PowerShell, GitHub URLs, external staging domains and secondary installers.
• Extract the Faronics ck identifier and identify every endpoint enrolled into the same deployment.
• Check email and web telemetry for the campaign’s invoice, tax, Adobe, Zoom and document-sharing themes.
• Review process creation involving curl, mshta, msiexec and PowerShell after an unexpected Faronics installation.
• Isolate affected systems, investigate subsequent commands and rotate credentials if interactive access or credential exposure is possible.
• Report suspected malicious deployments to Faronics so the associated tenant and related infrastructure can be disrupted.

Huntress reported the activity to Faronics on 5 August. The company said attackers attempted to create accounts using impersonated organisations, fraudulent domains and compromised accounts. It introduced additional controls and contacted organisations linked to potentially compromised accounts.

Beginning around 21 August, Huntress observed a sharp decline in malicious Faronics activity. That suggests vendor-side intervention had a practical effect, although it does not prove that every attacker-controlled installation or secondary ScreenConnect deployment has been removed.

The BlackTree view

This campaign did not exploit a Faronics vulnerability. It exploited the assumption that signed administrative software is safe regardless of who controls it.

Enterprise control needs to bind four things together: the approved product, the authorised tenant, the expected deployment method and the endpoint that should receive it. If policy checks only the publisher’s signature, an attacker can arrive through the front door wearing a legitimate vendor badge.

Defenders should treat remote-management enrolment like identity provisioning. New tenants, unfamiliar deployment identifiers and first-seen RMM agents deserve the same scrutiny as a newly created administrator account. The dangerous event is not that the software executed. It is that authority changed hands.

Sources and further reading

• Huntress: Daisy-Chaining Trust, Investigating Faronics Deploy Abuse, published 31 August 2026. The primary page provides no publication time.
• BleepingComputer: Hackers abuse Faronics Deploy admin tool to install ScreenConnect, published 1 September 2026 at 4:53 PM. The page does not state a timezone.