Bank of America Lookalike Emails Secretly Installing Remote-Access Software on Windows PCs: Report

Cybercriminals have launched a phishing campaign impersonating Bank of America to secretly install remote access software on targeted computers.

The emails closely copy the bank’s branding and direct recipients through multiple fake sites before pushing a download called Account Guard, reports reports Infosecurity Magazine.

Windows users who run the file trigger a multi-stage script chain that installs ScreenConnect remote monitoring software disguised as a Windows Security service.

Attackers employ evasion tactics including a UAC bypass to gain elevated privileges and connect the system to a command-and-control server.

Mac users instead receive prompts to enter personal details with no malware delivered, showing the campaign’s device-specific design.

ScreenConnect is legitimate remote management software that threat actors frequently abuse for persistent access after initial compromise.

The emails originated from a spoofed domain and arrived in a cybersecurity firm’s honeytrap account.

Experts advise users to verify email senders and link destinations carefully before clicking anything.

… Continue reading the full article at the original source below.