Most of the posts in this series look at what a phishing email does while it is still an email: what domain it claims to be from, what link it carries, what attachment it hides behind. Research Huntress published on September 2 describes a campaign where the email is barely the point. Between July 21 and August 20, Faronics-themed lures dressed up as invoices, tax documents, and other routine business files reached more than 457 endpoints, and every meaningful step of the attack happened after the recipient had already stopped looking at their inbox.
A Legitimate Installer Renamed Adobe.exe
The lure emails did not carry malware in any conventional sense. They carried a link or attachment that led to a genuinely signed installer for Faronics Deploy, a real endpoint-management platform IT teams use to push software and scripts across a fleet of machines, renamed to look like an Adobe reader, plugin update, or document viewer. Victims who ran the file, often saved as “Adobe.exe,” were not installing malware. They were installing legitimate software that happened to enroll their computer in a Faronics deployment tenant the attackers controlled rather than one their own IT department ran.
From Enrollment to Remote Access, Without a Second Email
Once a machine was enrolled, the attackers used Faronics Deploy’s own remote-deployment functionality, the exact feature the product is built to provide, to execute PowerShell scripts with no further clicks or prompts required. Those scripts pulled additional tooling from attacker infrastructure and from public sources including GitHub, ultimately installing ConnectWise ScreenConnect: another legitimate, signed remote-support tool, now running under the attacker’s control instead of a help desk’s. Huntress reported the abuse to Faronics on August 5. Faronics said it had also seen the same actors attempting to register their own Faronics accounts using impersonated organizations, fraudulent domains, and compromised accounts, effectively building the sending and hosting infrastructure to scale the campaign. The company added anti-abuse measures and began contacting affected organizations, and observed activity dropped sharply starting August 21.
Why DMARC Was Never Built to Catch This
DMARC answers one question about one artifact: did the domain in a message’s From header authorize the infrastructure that sent it. That question applies to the opening lure email and stops applying the moment a recipient clicks through and downloads a file. The Faronics installer is signed by a real vendor. The deployment platform is doing precisely what it is designed to do. ScreenConnect is software help desks install every day. None of the three is a message with a From header, which means none of the three is something DMARC has any way to evaluate. A domain owner can enforce DMARC at p=reject on every domain they own and still learn nothing about a machine that just enrolled itself in a deployment console the security team has never heard of, because by the time that happens, email authentication has already finished the only job it was designed to do.
What This Means for Your Program
Treat the lure email as the opening move, not the whole incident. Filtering and awareness training that stop at “did this message look legitimate” miss the entire installer chain that follows a single click, which is where this campaign actually did its work.
Watch for unexpected enrollment in remote management platforms your organization does not run. A machine appearing in an unfamiliar deployment console is a stronger signal of compromise than anything visible in the email that led to it.
Extend your trust review to signed software you did not deploy yourself. A valid code signature answers “was this file tampered with,” not “should this vendor’s software be running on this network,” and attackers are counting on that distinction going unexamined.
Report abuse of legitimate platforms to the vendor quickly. Huntress’s August 5 disclosure to Faronics is a large part of why this campaign’s activity collapsed by August 21; vendors can move fast against abuse of their own infrastructure once they know it is happening.
The Takeaway
DMARC did its job on the email that started this chain, whatever that job’s outcome was, and then the attack moved entirely into territory DMARC was never built to see: a signed installer, a legitimate deployment platform, and a remote-support tool doing exactly what each was designed to do, just for the wrong operator. Closing that gap means watching what a click leads to, not just what a From header claims.
DMARC confirms a domain had the authority to send a message. It cannot tell you that a signed, legitimate installer someone downloaded a minute after opening that message just enrolled their machine in an attacker’s own deployment console. Excello Mail turns your DMARC aggregate reports into a clear, continuous record of every domain and service sending as you, so the authentication layer stays airtight while your team watches for what an attachment or link leads to after the message itself is gone. Sign up for free to Excello Mail and get that foundation in place.