Every link in this chain is a legitimate paid service. The only malicious artefact is a configuration

Nothing in the chain is malware

Allure Security published research on 25 September 2026 into a campaign offering desktop applications for three large payroll and human resources platforms.

The first thing to understand is that the products being impersonated do not exist. All three providers deliver their service as a web application, with mobile companions. As the firm's director of security research, Ryan Merritt, put it: "none offers a desktop application for its current platform."

Now walk the chain, and notice what is in it:

• The download pages were built with Lovable, an AI application builder
• They were hosted on Vercel, behind bot challenge screens
• The download button pointed at a release file in a GitHub repository, with a separate account per impersonated brand
• The installer, about 64 MB, first runs a genuine Microsoft .NET Desktop Runtime 8.0.26 installer
• Behind that, it silently installs ScreenConnect, commercial remote support software, using the Windows Installer quiet flag
• The remote access tool is configured for unattended access with notifications disabled, running as a Windows service that survives reboots

Every component on that list is a legitimate, generally paid, widely used service or product. The only artefact in the entire chain that is unambiguously malicious is the configuration applied to the last one.

What that does not establish. It does not establish that any of the named services did anything wrong, and none of them is accused here. It does not establish how many people were actually compromised. It does not establish who is behind it: Allure attributes the parallel cryptocurrency campaign to a separate operator cluster on the basis of a different signer, certificate authority, code hosting accounts and live chat licences, and names nobody. And the three impersonated providers are not named in the research, so no reader can check their own exposure against a brand.

The numbers, including the one the researchers discount themselves

Two figures are published and both are worth handling carefully, which is what the researchers did.

The GitHub download counts across the three fake applications totalled 291. Allure says explicitly that this includes downloads by its own researchers, and probably by other researchers and sandboxes. So the real victim count is smaller than 291 by an unknown amount, and the firm publishing the number is the one telling you that.

Merritt's framing of why it still matters is the right one: "when you consider the potential impact of drained company payroll accounts, they are non-trivial." A campaign that reaches a handful of people who run payroll is not a small campaign.

The second figure: at the time of analysis, 32 of 70 engines flagged the installer as malicious. That is 45.7 per cent, which means more than half of a large detection panel did not.

Each stage of the chain, what it is, and whether anything about it is inherently suspicious. From Allure Security's research as reported on 25 September 2026.

Stage	What is used	Anything malicious in itself?
The lure page	An AI application builder	No. It is a product for building pages quickly
The hosting	A mainstream cloud platform	No, and a bot challenge in front makes it look more legitimate
The file	A release asset on a public code host	No. This is how software is normally distributed
The first installer	Microsoft .NET Desktop Runtime 8.0.26	No. It is genuine and signed by Microsoft
The payload	Commercial remote support software	No. It is used lawfully by thousands of help desks
The configuration	Unattended access, notifications off, service persistence	Yes. This is the entire attack

The lure is a product gap

The cleverest part of this campaign is not technical at all.

Phishing usually impersonates something that exists, which gives the target a reference point. A fake login page can be compared to the real one. A fake invoice can be checked against the supplier. Here there is nothing to compare, because the thing being offered has never existed.

What it offers instead is something the user already wants. Anyone who spends their working day in a browser tab running payroll has, at some point, wished for a desktop application. The lure is not a trick so much as an answer to a request the vendor has not met.

And consider who is most likely to go looking. Not the general workforce. The people who run payroll, whose machines have access to the systems that move an entire organisation's salaries. Merritt's phrase for the consequence of unattended access on one of those machines is "a path to diverting or draining an entire company's payroll".

That is the part to take to a risk conversation. The population most likely to install this is precisely the population whose compromise is worst, and the reason they install it is a legitimate frustration with the real product.

There is a second cluster in the same research, using the same method against cryptocurrency exchange, wallet and decentralised finance brands, with the same kind of remote access payload. Allure separates it from the payroll activity on the basis of a different signer, a different certificate authority, different code hosting accounts and different live chat licences.

That separation is worth noticing for what it implies about the method rather than the actors. Two unrelated groups arrived at the same construction independently, which is what happens when a technique is cheap, the components are commodity, and the only scarce input is deciding which brand to impersonate.

What to do about it

The question this leaves

There is a version of this story about criminals abusing free tiers, and it would miss the point. The services in this chain are not being abused in any way their operators could easily distinguish from ordinary use. Somebody built a page, hosted it, published a release, and installed two pieces of legitimate software in an order and with settings of their choosing.

That is the uncomfortable shape of a lot of current intrusion work. The artefacts are clean. The infrastructure is paid for. The detection surface is not a file but a configuration, and configurations are not what most of the industry's tooling was built to inspect.

So the question for your own controls: if every binary involved in an attack were signed, legitimate and individually harmless, which of your defences would still have something to say?