--- title: Bank of America Phishing Email Delivers ScreenConnect... description: A phishing email impersonating Bank of America directs victims to a fake banking site that delivers a ZIP file containing a malicious VBScript. Executing it... canonical: https://daily.dev/posts/bank-of-america-phishing-email-delivers-screenconnect-malware-efdxoimvq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Bank of America Phishing Email Delivers ScreenConnect Malware | daily.dev og:description: A phishing email impersonating Bank of America directs victims to a fake banking site that delivers a ZIP file containing a malicious VBScript. Executing it... og:url: https://daily.dev/posts/bank-of-america-phishing-email-delivers-screenconnect-malware-efdxoimvq og:image: https://api.daily.dev/og/posts/EFdXOimVQ.png og:image:alt: Bank of America Phishing Email Delivers ScreenConnect Malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bank of America Phishing Email Delivers ScreenConnect Malware **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 9 min read · 0 upvotes · 0 comments ## Summary A phishing email impersonating Bank of America directs victims to a fake banking site that delivers a ZIP file containing a malicious VBScript. Executing it triggers a multi-stage chain of nested base64-encoded and AES-encrypted PowerShell scripts that ultimately installs a ScreenConnect RMM tool with Administrator privileges via a known ICMLuaUtil UAC bypass exploit. The malware then uses SDDL and ACL manipulation to hide the ScreenConnect service, rename it as 'Windows Security,' block removal, and establish command-and-control over a suspicious IP in the UAE. Indicators of compromise and mitigation guidance, including checking sender domains and URLs, are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the ICMLuaUtil COM interface UAC bypass work to install malware silently on Windows? It abuses the Elevated COM interface ICMLuaUtil, which corresponds to MITRE ATT&CK technique T1548.002, to run arbitrary PowerShell commands with Administrator privileges without triggering the UAC prompt normally shown to users. In one observed attack, this let a threat actor compile and execute C# code that installed ScreenConnect RMM software with elevated rights undetected, using exploit code originally published years earlier on GitHub. _Security teams tracking UAC bypass techniques and privilege escalation exploits follow writeups like this on daily.dev._ ### How can attackers hide a malicious ScreenConnect installation from Windows users so it can't be found or removed? By deleting the registry key pointing to the ScreenConnect installer, renaming the service to something innocuous like 'Windows Security,' and applying custom SDDL strings and audit ACLs that block users, admins, and other services from viewing, modifying, logging, or uninstalling it. The malware also hides the folder C:\ProgramData\Windows Security from Windows Explorer, making remediation significantly harder than a typical malware removal. _Incident responders dealing with hidden persistence mechanisms track techniques like SDDL abuse on daily.dev._ ### What are common red flags of a Bank of America phishing email that delivers malware instead of a legitimate security update? Red flags include a sender address that doesn't match the bank's real domain, a time-pressured warning about account restrictions, a link that redirects through unrelated domains before reaching a spoofed page, and a download prompt like 'Account Guard' delivering a .vbs script file. Legitimate financial institutions do not distribute security software as VBScript attachments, and checking the browser address bar reveals the mismatched domains. _Developers building phishing detection or email security tooling can track scam patterns like this via daily.dev._ ## Similar posts on daily.dev - [Fake Bank of America Phishing Emails Found Delivering Disguised ScreenConnect RAT via UAC Bypass](https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei) · IT Security Guru · 0 upvotes · 0 comments - [Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs](https://daily.dev/posts/phishing-campaign-abuses-microsoft-power-bi-to-deploy-rogue-rmms-1milpzhuq) · Huntress Blog · 0 upvotes · 0 comments - [How a single ScreenConnect incident exposed a massive campaign](https://daily.dev/posts/how-a-single-screenconnect-incident-exposed-a-massive-campaign-hxzs54kdz) · Securelist · 0 upvotes · 0 comments - [Power BI phishing campaign drops rogue ScreenConnect clients](https://daily.dev/posts/power-bi-phishing-campaign-drops-rogue-screenconnect-clients-t7irn2cgb) · IT Security Guru · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/bank-of-america-phishing-email-delivers-screenconnect-malware-efdxoimvq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Bank of America Phishing Email Delivers ScreenConnect Malware","url":"https://daily.dev/posts/bank-of-america-phishing-email-delivers-screenconnect-malware-efdxoimvq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bank-of-america-phishing-email-delivers-screenconnect-malware-efdxoimvq"},"datePublished":"2026-08-18T16:16:33.498Z","dateModified":"2026-09-14T07:55:06.985Z","description":"A phishing email impersonating Bank of America directs victims to a fake banking site that delivers a ZIP file containing a malicious VBScript. Executing it...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5588263c4aa2f61ce5aef536f23070c1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5588263c4aa2f61ce5aef536f23070c1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bank-of-america-phishing-email-delivers-screenconnect-malware-efdxoimvq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,phishing,powershell","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"Bank of America Phishing Email Delivers ScreenConnect Malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bank-of-america-phishing-email-delivers-screenconnect-malware-efdxoimvq#faq","mainEntity":[{"@type":"Question","name":"How does the ICMLuaUtil COM interface UAC bypass work to install malware silently on Windows?","acceptedAnswer":{"@type":"Answer","text":"It abuses the Elevated COM interface ICMLuaUtil, which corresponds to MITRE ATT&CK technique T1548.002, to run arbitrary PowerShell commands with Administrator privileges without triggering the UAC prompt normally shown to users. In one observed attack, this let a threat actor compile and execute C# code that installed ScreenConnect RMM software with elevated rights undetected, using exploit code originally published years earlier on GitHub. Security teams tracking UAC bypass techniques and privilege escalation exploits follow writeups like this on daily.dev."}},{"@type":"Question","name":"How can attackers hide a malicious ScreenConnect installation from Windows users so it can't be found or removed?","acceptedAnswer":{"@type":"Answer","text":"By deleting the registry key pointing to the ScreenConnect installer, renaming the service to something innocuous like 'Windows Security,' and applying custom SDDL strings and audit ACLs that block users, admins, and other services from viewing, modifying, logging, or uninstalling it. The malware also hides the folder C:\\ProgramData\\Windows Security from Windows Explorer, making remediation significantly harder than a typical malware removal. Incident responders dealing with hidden persistence mechanisms track techniques like SDDL abuse on daily.dev."}},{"@type":"Question","name":"What are common red flags of a Bank of America phishing email that delivers malware instead of a legitimate security update?","acceptedAnswer":{"@type":"Answer","text":"Red flags include a sender address that doesn't match the bank's real domain, a time-pressured warning about account restrictions, a link that redirects through unrelated domains before reaching a spoofed page, and a download prompt like 'Account Guard' delivering a .vbs script file. Legitimate financial institutions do not distribute security software as VBScript attachments, and checking the browser address bar reveals the mismatched domains. Developers building phishing detection or email security tooling can track scam patterns like this via daily.dev."}}]} ```