--- title: Fake Bank of America Phishing Emails Found Delivering... description: Huntress researchers uncovered an active phishing campaign impersonating Bank of America that delivers a trojanized ScreenConnect RMM installer to Windows... canonical: https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fake Bank of America Phishing Emails Found Delivering Disguised ScreenConnect RAT via UAC Bypass | daily.dev og:description: Huntress researchers uncovered an active phishing campaign impersonating Bank of America that delivers a trojanized ScreenConnect RMM installer to Windows... og:url: https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei og:image: https://api.daily.dev/og/posts/cEgwiaIEI.png og:image:alt: Fake Bank of America Phishing Emails Found Delivering Disguised ScreenConnect RAT via UAC Bypass og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fake Bank of America Phishing Emails Found Delivering Disguised ScreenConnect RAT via UAC Bypass **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 3 min read · 0 upvotes · 0 comments ## Summary Huntress researchers uncovered an active phishing campaign impersonating Bank of America that delivers a trojanized ScreenConnect RMM installer to Windows users. The attack chain uses a VBScript-triggered multi-stage base64 decoding process, a PowerShell script to fetch the installer, and AES-128-CBC-encrypted payloads. One payload exploits the ICMLuaUtil COM interface (MITRE ATT&CK T1548.002) to bypass UAC and install ScreenConnect with admin privileges silently. A second payload hides the service under the name 'Windows Security' using SDDL/ACL manipulation to prevent removal even by admins. The C2 server is located in the UAE on port 8041/tcp. Huntress has published full indicators of compromise and recommends monitoring for unauthorized ScreenConnect installs and unusual ACL changes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the fake Bank of America phishing campaign bypass UAC to install ScreenConnect silently? It exploits the ICMLuaUtil Elevated COM interface, a known UAC bypass technique mapped to MITRE ATT&CK T1548.002, using C# code lifted from a public GitHub proof-of-concept. This lets the malicious ScreenConnect installer run with Administrator privileges without triggering the UAC prompt, then hides itself by deleting the installer's registry key and applying SDDL/ACL restrictions under the disguised service name Windows Security. _Track emerging UAC bypass and RMM abuse techniques like this one on daily.dev._ ### What data does the Mac version of this Bank of America phishing page try to steal compared to the Windows version? Mac users and anyone with a non-Windows user agent see a conventional credential-harvesting page that also solicits full mailing addresses, government ID numbers, Social Security numbers, and card payment details, while Windows users are instead pushed to download a Trojanised ScreenConnect installer disguised as 'Account Guard' protection software. _Security teams comparing phishing kit behavior across platforms can follow campaigns like this on daily.dev._ ### What C2 infrastructure does the malicious ScreenConnect installer from the Bank of America phishing campaign contact? The compromised host reaches out to a command-and-control address located in the United Arab Emirates over port 8041/tcp. Huntress has published full indicators of compromise, including malicious domains, the C2 IP address, and file hashes, to its GitHub repository, and recommends monitoring for unauthorized ScreenConnect installations and unusual SDDL/ACL modifications. _Defenders hunting for RMM abuse indicators can keep pace with new IOCs like these via daily.dev._ ## Similar posts on daily.dev - [Bank of America Phishing Email Delivers ScreenConnect Malware](https://daily.dev/posts/bank-of-america-phishing-email-delivers-screenconnect-malware-efdxoimvq) · Huntress Blog · 0 upvotes · 0 comments - [How a single ScreenConnect incident exposed a massive campaign](https://daily.dev/posts/how-a-single-screenconnect-incident-exposed-a-massive-campaign-hxzs54kdz) · Securelist · 0 upvotes · 0 comments - [Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns](https://daily.dev/posts/hijacked-screenconnect-installs-are-spreading-malware-like-a-worm-huntress-warns-1l5fefot8) · IT Security Guru · 0 upvotes · 0 comments - [Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity](https://daily.dev/posts/rogue-screenconnect-installations-across-unrelated-hosts-suggest-worm-like-activity-vtbdp9bzq) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fake Bank of America Phishing Emails Found Delivering Disguised ScreenConnect RAT via UAC Bypass","url":"https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei"},"datePublished":"2026-08-04T14:06:33.995Z","dateModified":"2026-09-14T06:39:42.385Z","description":"Huntress researchers uncovered an active phishing campaign impersonating Bank of America that delivers a trojanized ScreenConnect RMM installer to Windows...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/abf118a62ea746f6dfa1dfd8abd99eec?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/abf118a62ea746f6dfa1dfd8abd99eec?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,phishing","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"Fake Bank of America Phishing Emails Found Delivering Disguised ScreenConnect RAT via UAC Bypass"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fake-bank-of-america-phishing-emails-found-delivering-disguised-screenconnect-rat-via-uac-bypass-cegwiaiei#faq","mainEntity":[{"@type":"Question","name":"How does the fake Bank of America phishing campaign bypass UAC to install ScreenConnect silently?","acceptedAnswer":{"@type":"Answer","text":"It exploits the ICMLuaUtil Elevated COM interface, a known UAC bypass technique mapped to MITRE ATT&CK T1548.002, using C# code lifted from a public GitHub proof-of-concept. This lets the malicious ScreenConnect installer run with Administrator privileges without triggering the UAC prompt, then hides itself by deleting the installer's registry key and applying SDDL/ACL restrictions under the disguised service name Windows Security. Track emerging UAC bypass and RMM abuse techniques like this one on daily.dev."}},{"@type":"Question","name":"What data does the Mac version of this Bank of America phishing page try to steal compared to the Windows version?","acceptedAnswer":{"@type":"Answer","text":"Mac users and anyone with a non-Windows user agent see a conventional credential-harvesting page that also solicits full mailing addresses, government ID numbers, Social Security numbers, and card payment details, while Windows users are instead pushed to download a Trojanised ScreenConnect installer disguised as 'Account Guard' protection software. Security teams comparing phishing kit behavior across platforms can follow campaigns like this on daily.dev."}},{"@type":"Question","name":"What C2 infrastructure does the malicious ScreenConnect installer from the Bank of America phishing campaign contact?","acceptedAnswer":{"@type":"Answer","text":"The compromised host reaches out to a command-and-control address located in the United Arab Emirates over port 8041/tcp. Huntress has published full indicators of compromise, including malicious domains, the C2 IP address, and file hashes, to its GitHub repository, and recommends monitoring for unauthorized ScreenConnect installations and unusual SDDL/ACL modifications. Defenders hunting for RMM abuse indicators can keep pace with new IOCs like these via daily.dev."}}]} ```