Full Report
A fake Bank of America phishing email kicks off a multi-stage malware infection chain. See how one convincing bank scam unravels.
Analysis Summary
# Incident Report: Multi-Stage Phishing Campaign Delivering Unauthorized RMM
## Executive Summary
A sophisticated phishing campaign targeting Bank of America customers utilizes branded social engineering to deploy unauthorized Remote Monitoring and Management (RMM) software. While Mac users are directed to a credential harvesting site, Windows users are prompted to install "Account Guard," which initiates a multi-stage infection chain ending in a hidden ScreenConnect installation. This allows threat actors persistent, administrative remote access to the victim's machine while bypassing standard security prompts.
## Incident Details
- **Discovery Date:** July 28, 2026 (Reported August 4, 2026)
- **Incident Date:** July 28, 2026
- **Affected Organization:** Multiple (Targets of Bank of America phishing)
- **Sector:** Financial Services (Impersonated) / General Consumer & Business (Victims)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** July 28, 2026
- **Vector:** Phishing Email (Malspam)
- **Details:** An email from `onlinebanking@ealerts[.]bkofamerica[.]com` warns of account restrictions, directing users to a look-alike "Security Center" landing page via a redirector URL.
### Lateral Movement
- **Details:** Not explicitly detailed in the report, though the installation of ScreenConnect provides the necessary infrastructure for future lateral movement within the compromised network.
### Data Exfiltration/Impact
- **Credential Theft:** Mac/Mobile users are redirected to pages harvesting PII, SSNs, and credit card details.
- **System Compromise:** Windows users suffer full system takeover via RMM installation.
### Detection & Response
- **Discovery:** Identified by Huntress via a honeytrap (spamtrap) email account.
- **Response Actions:** Technical analysis of the multi-stage decoding chain and identification of the C2 infrastructure.
## Attack Methodology
- **Initial Access:** Phishing email with a link to a fraudulent website.
- **Persistence:** Installation of a persistent ScreenConnect (ConnectWise) agent.
- **Privilege Escalation:** Use of a complex `.vbs` and PowerShell chain to execute the `.msi` installer with Administrator privileges, bypassing UAC prompts.
- **Defense Evasion:**
- Use of multi-stage Base64 encoded scripts to hide malicious intent.
- Post-installation scripts to hide the ScreenConnect icon from the system tray.
- Disabling the user's ability to uninstall or see the service in the UI.
- **Discovery:** User-Agent sniffing (Redirecting Windows vs. Mac users to different payloads).
- **Impact:** Unauthorized remote access and potential full identity theft.
## Impact Assessment
- **Financial:** Potential for unauthorized bank transfers and credit card fraud.
- **Data Breach:** High-volume PII theft (SSN, Address, Government ID, Payment details).
- **Operational:** Threat actor gains persistent "hands-on-keyboard" access to local systems.
- **Reputational:** Brand damage to Bank of America through highly convincing impersonation.
## Indicators of Compromise
- **Network Indicators:**
- `ealerts[.]bkofamerica[.]com` (Sender Domain)
- **File Indicators:**
- `AccountGuard.zip` (Malicious archive)
- `AccountGuard.vbs` (Initial script loader)
- **Behavioral Indicators:**
- Execution of PowerShell commands with large Base64 encoded strings.
- Unauthorized installation of ScreenConnect in a consumer/unmanaged environment.
- Modification of registry keys to hide system tray icons for RMM tools.
## Response Actions
- **Containment:** Blocked identified sender domains and phishing URLs at the mail gateway and DNS level.
- **Eradication:** Identify and remove unauthorized ScreenConnect instances and associated persistence scripts.
- **Recovery:** Victim identity monitoring and password resets for affected banking accounts.
## Lessons Learned
- **Advanced Evasion:** Attackers are successfully using "legitimate" RMM tools to bypass traditional antivirus that may only look for "known-bad" malware.
- **Sniffing Tradecraft:** The use of User-Agent checking allows attackers to maximize their "return" by serving either credential phishing or malware based on the platform.
## Recommendations
- **Email Security:** Implement DMARC/SPF/DKIM checks to identify spoofed headers.
- **Software Restrictions:** Use AppLocker or similar tools to prevent the execution of unauthorized `.vbs` scripts and `.msi` installers from the `Downloads` directory.
- **RMM Monitoring:** Organizations should monitor for the installation of RMM tools (ScreenConnect, AnyDesk, etc.) that are not part of their official IT stack.
- **User Training:** Educate users that financial institutions will never ask for a software installation (like "Account Guard") to verify account information.