Cybercriminals are deploying a sophisticated phishing operation that mimics Bank of America communications to install remote access software on victims' computers, according to an analysis published by cybersecurity firm Huntress. The fraudulent emails, first detected on July 28 when they arrived at a Huntress honeytrap account, replicate the bank's visual design and branding from the initial message through to the fake webpage where targets are sent. The campaign ultimately delivers ScreenConnect remote monitoring software, granting attackers complete control over compromised systems.
The attack unfolds through a multi-stage process that begins with emails appearing to come from bkofamerica[.]com rather than the bank's legitimate domain. When recipients click what's labeled as a "Security Centre" link, they're directed first to kleinschnitg[.]com, then redirected to sectioncompil[.]com, where a malicious compressed file originates. The scam operates differently depending on the victim's device: Mac users receive no malicious file but are instead asked to provide valuable personal data, while Windows users are prompted to download software called "Account Guard," marketed as "a powerful tool designed to protect your financial data, prevent unauthorized transactions and other cyber threats." Clicking an "Update My Information" button delivers AccountGuardSetup.zip, containing a Visual Basic Script file that, when run, installs the ScreenConnect remote management tool on the target's machine.
The technical execution involves several layers of obfuscation and evasion tactics. Each stage includes large Base64-encoded data segments that decode into further scripts, ultimately producing a PowerShell payload that retrieves a 17MB Base64-encoded installer from UploadToURL.com and writes a ScreenConnect MSI package onto the victim's system. To avoid detection, the malware disguises ScreenConnect as a service labeled "Windows Security," erases installation traces, conceals related files and services through Windows permissions, and blocks standard removal procedures. Once active, ScreenConnect connects to a suspected command-and-control server at the IP address 217.60.195[.]167 over TCP port 8041, waiting for instructions from the attacker. The IP address traces to the United Arab Emirates and has a poor reputation, with multiple other malware families apparently using this address for command-and-control operations. The attacker can also elevate privileges silently by deploying a C# script that exploits the ICMLuaUtil COM interface UAC bypass.
The researchers recommend paying close attention to email origins and link destinations as the most straightforward defense against this type of attack. Organizations should verify that correspondence claiming to come from financial institutions uses legitimate domains before clicking any embedded links. The campaign highlights how threat actors continue refining social engineering techniques by closely imitating trusted brands' visual identity while routing victims through multiple compromised or malicious domains to obscure the attack's true nature. For businesses, the case underscores the importance of endpoint detection that can identify remote access tools being installed without proper authorization, even when disguised as legitimate security software. The layered technical approach—combining convincing visual mimicry with device-specific payloads and advanced evasion techniques—represents a blueprint that other criminal groups may adapt for future campaigns targeting different financial institutions or service providers.