Researchers Reveal Sophisticated Phishing Scheme Targeting Bank of America Clients
In a concerning development, researchers from Huntress have uncovered an active phishing campaign that masquerades as correspondence from Bank of America, ultimately facilitating the covert installation of a remote monitoring and management (RMM) tool. This alarming tactic grants attackers persistent access to victims’ Windows machines, making detection significantly challenging.
The investigation into this phishing campaign began when Huntress received a suspicious email on July 28, delivered to one of their spamtrap accounts. The email emanated from a spoofed address designed to mimic a genuine Bank of America domain, effectively disguising its malicious intent. Its contents employed a classic social engineering technique that has proven effective over time: it contained a time-sensitive warning instructing the recipient to “confirm” their account details. Failure to do so threatened the imposition of restrictions, a strategy that plays on urgent fears of compromised accounts.
Device-Dependent Payloads
Delving deeper into the mechanics of this campaign, Huntress discovered that the phishing infrastructure is designed to fingerprint the device of the recipient, dynamically adjusting the content delivered based on the detected operating system. For Mac users, or any individuals utilizing non-Windows user agents, the phishing attempt forwards users to a standard credential-harvesting page. This page does not merely solicit usernames and passwords; it demands a comprehensive array of personal data, including full mailing addresses, Social Security numbers, government identification, and credit card details. In stark contrast, Windows users are presented with a prompt encouraging the download of a so-called “Account Guard,” portrayed on the counterfeit webpage as protective software. However, what they do not realize is that this is, in fact, a Trojanized installer for ScreenConnect, a legitimate RMM tool frequently exploited by malicious actors.
Layered Obfuscation and UAC Bypass
Upon downloading, the archive introduces a more complex layer of deceit. It contains a Visual Basic Script that initiates an intricate decoding sequence. Throughout this process, base64-encoded payloads are nested in several layers, ultimately leading to the execution of a PowerShell script. This script retrieves a 17MB ScreenConnect installer from a public file-sharing site and decrypts two data blobs that have been encrypted with AES-128-CBC.
One of these blobs reveals C# source code that is believed to be taken directly from a public proof-of-concept available on GitHub. This code employs a known User Account Control (UAC) bypass technique, specifically exploiting the ICMLuaUtil Elevated COM interface, a method cataloged under MITRE ATT&CK T1548.002. This tactic allows the ScreenConnect installer to execute with Administrator privileges without triggering the UAC prompt that users are typically trained to notice.
The second blob consists of a VBScript designed to delete the registry key that points to the installer while applying Security Descriptor Definition Language (SDDL) strings and access control lists. Such measures prevent the service, which is misleadingly named “Windows Security,” from being easily identified, disabled, or removed—even by users with administrative rights. Following this clandestine installation, the compromised machine connects to a command-and-control (C2) address located in the United Arab Emirates via port 8041/tcp.
Detection and Mitigation Strategies
Huntress emphasizes that the phishing campaign is detectable right at its inception. Neither the sending domain nor the embedded redirect link correlates with Bank of America’s actual infrastructure. This discrepancy is visible in the browser’s address bar prior to any potentially harmful file downloads, providing a crucial point for intervention.
To safeguard against such attacks, the firm has compiled a full list of indicators of compromise. This includes malicious domains, associated C2 IP addresses, and crucial file hashes, making them available on their GitHub repository. Huntress strongly advises organizations to remain vigilant for unauthorized ScreenConnect installations and any unusual changes in SDDL/ACL settings on endpoint services.
The findings from Huntress reinforce an ongoing narrative within the cybersecurity landscape: the abuse of RMM tools remains a favored method for cybercriminals aiming to maintain persistent access while evading conventional malware detection techniques. When paired with phishing schemes that closely mimic the visual identity of reputable companies, such as Bank of America, there exists a heightened risk, particularly for unsuspecting users. This revelation serves as a stark reminder to individuals and organizations alike to remain vigilant against the ever-evolving threats in the digital sphere.