Fake Bank Alerts Facilitate RMM Access

Orchestrated Impersonation Tactics

Cybersecurity researchers at Huntress have uncovered a targeted phishing campaign that leverages the visual identity of Bank of America to compromise user systems. The campaign, which was first identified via a honeytrap account on July 28, mimics the bank's branding across email communications and redirected web landing pages to deceive unsuspecting targets.

While the visual elements are designed to appear legitimate, the underlying infrastructure relies on fraudulent domains. The emails originate from addresses that do not align with the bank’s official domain, instead directing users to sites such as bkofamerica[.]com and kleinschnitg[.]com before landing on a malicious portal at sectioncompil[.]com.

Multi-Stage Malware Delivery

The attack vector varies significantly depending on the target's operating system. While Mac users are diverted to a credential-harvesting prompt intended to steal personal data, Windows users face a more technical payload delivery system. Targets are encouraged to download a purported security utility named "Account Guard," which is presented as a legitimate tool to defend against unauthorized financial transactions.

Executing the associated Visual Basic script initiates a complex, multi-stage infection chain. The process involves decoding large Base64 data blobs to eventually execute a PowerShell payload. This final step facilitates the download of a 17MB installer, which deploys the ScreenConnect remote monitoring and management (RMM) software onto the host system.

The simplest way to mitigate an attack like this is to pay close attention to where an email comes from, and where any links point.

— Huntress, cybersecurity firm

Persistence and Evasion

Once deployed, the malware attempts to maintain long-term access by masking the ScreenConnect installation as a service labeled "Windows Security." The attackers utilize various techniques to hide files and associated services, including the manipulation of Windows permissions to hinder standard uninstallation attempts.

The malware also leverages the ICMLuaUtil COM interface to perform a UAC bypass, allowing for silent privilege escalation. Following setup, the software establishes a persistent connection to a command-and-control (C2) server located at 217.60.195[.]167, utilizing TCP port 8041 for incoming instructions.

• Initial detection date: July 28
• Malware payload size: 17MB
• C2 server IP address: 217.60.195[.]167
• C2 communication port: 8041

Implications for Security

This incident illustrates how threat actors continue to repurpose legitimate remote access tools for malicious ends, complicating the work of security teams who must differentiate between authorized administrative software and unauthorized intrusions. Because these campaigns rely on human interaction rather than software vulnerabilities, they pose a persistent risk to employees and consumers alike. Organizations could consider implementing strict email filtering and endpoint controls that restrict the execution of unauthorized RMM tools to mitigate the potential impact of similar phishing-based deployments.