Hackers Leverage Faronics Deploy to Deploy Unauthorized ScreenConnect Remote Access

Security researchers have identified a new phishing campaign that exploits the legitimate Faronics Deploy endpoint‑management platform to install the ScreenConnect remote‑support tool on compromised machines, giving attackers full administrative control.

The malicious actors first deliver a phishing email containing a deceptive link or attachment. When the victim follows the instructions, the attackers gain access to the organization’s Faronics Deploy console, a widely used utility for software distribution and system updates. By abusing the console’s administrative privileges, they push the ScreenConnect client—often disguised as a routine update—across the network without detection.

ScreenConnect, also known as ConnectWise Control, is a legitimate remote‑desktop solution frequently employed by IT teams for troubleshooting. In this abuse scenario, however, the software becomes a backdoor, allowing the perpetrators to execute commands, exfiltrate data, and move laterally within the target environment. Because the installation originates from a trusted management tool, standard security alerts may be bypassed, increasing the risk of prolonged undetected access.

Faronics Deploy, designed to streamline patch management and software deployment, does not inherently contain vulnerabilities that facilitate this attack. Instead, the threat hinges on compromised credentials or misconfigured access controls within the management console. Organizations that grant broad administrative rights to a limited number of users are especially vulnerable, as a single compromised account can cascade into network‑wide exploitation.

Experts advise immediate steps to mitigate the threat: verify the integrity of all Deploy console accounts, enforce multi‑factor authentication, and audit recent deployment logs for unauthorized software pushes. Additionally, monitoring network traffic for unexpected ScreenConnect connections can help detect active sessions. IT teams should also consider segmenting endpoint‑management tools from the broader corporate network to limit potential lateral movement.

While the campaign’s origins remain unclear, its reliance on legitimate software underscores a growing trend where cybercriminals weaponize trusted utilities to evade detection. As remote work and cloud‑based management solutions become more prevalent, security professionals are urged to reassess the balance between operational efficiency and the exposure of privileged tools. Ongoing vigilance and rapid response to anomalous deployment activity will be key to preventing further abuse of platforms like Faronics Deploy.