Executive Summary
Between July and August 2026, a surge in phishing campaigns was observed abusing Faronics Deploy, a legitimate endpoint management platform. Attackers utilize Adobe-themed lures to trick victims into installing a signed Faronics agent. Once enrolled in the attacker-controlled environment, the platform's legitimate deployment capabilities are used to execute PowerShell and install secondary remote access tools like ScreenConnect.
This campaign is significant due to its use of 'visitor-based cloaking' on delivery domains to evade analysis and its reliance on trusted, signed software to bypass traditional security controls. While Faronics has implemented disruptive measures, organizations remain at risk if unauthorized RMM tools are successfully deployed, leading to full endpoint compromise and potential lateral movement.