Threat actors are leveraging the legitimate Faronics Deploy endpoint-management platform to gain administrative control over targeted computers and install ScreenConnect remote support software.
Phishing campaigns are directing victims to download compromised versions or manipulated installers of Faronics Deploy, a widely-used system administration tool. Once installed, attackers exploit the platform's built-in capabilities to escalate privileges and deploy ScreenConnect without user knowledge.
ScreenConnect, a legitimate remote support utility, becomes a persistence mechanism in these attacks, allowing hackers to maintain long-term access to compromised systems.
The campaign targets organizations across multiple sectors. Victims typically receive phishing emails with convincing social engineering tactics designed to bypass security awareness.
Security researchers recommend organizations:
- Verify software downloads from official sources only
- Implement email security controls to block phishing attempts
- Monitor for unauthorized ScreenConnect installations
- Apply available patches to Faronics Deploy
- Conduct endpoint audits for suspicious remote access tools
Faronics has been notified of the abuse. Affected organizations should review access logs and investigate any suspicious administrative activities on their networks.
X is investigating a surge of unsolicited password reset emails following the launch of its X Money payments service. The company believes the incidents may be connected to the new platform.
Aesto Health disclosed a data breach affecting over 9.5 million individuals. The company discovered the unauthorized access to patient information recently.
Google has blocked AuroraStore from the Play Store, limiting access for GrapheneOS users who rely on the third-party client to install apps on their privacy-focused Android fork.
Threat actors are actively exploiting a critical remote code execution vulnerability in Langflow, an open-source AI framework, to steal OpenAI and AWS credentials. The unauthenticated flaw (CVE-2026-0768) requires no login to trigger.