Phishing actors abuse Faronics Deploy to install ScreenConnect for remote control

Threat actors are abusing the legitimate Faronics Deploy endpoint-management tool in phishing campaigns to gain remote administrative access and install ScreenConnect, a remote support software, on victim machines. This technique leverages trusted software to bypass security controls, enabling persistent access. The full scope and targeted sectors remain unclear, but the abuse of legitimate admin tools signals an evolving evasion tactic.