Fake Bank of America Phishing Emails Found Delivering Disguised ScreenConnect RAT via UAC Bypass

Summary

Huntress researchers discovered an active phishing campaign impersonating Bank of America that delivers a disguised ScreenConnect remote access trojan (RAT) to Windows systems. The malware leverages a UAC bypass technique to gain persistent, covert access to compromised machines. The campaign was identified after a malicious email was captured in Huntress's spamtrap on July 28.

Indicators of Compromise

• malware — ScreenConnect RAT

Entities