HawkTalk: Cybersecurity for SMBs
Not every attack starts with a suspicious email. A fake download page and a familiar Windows prompt can be enough to let an attacker in. A campaign identified by Palo Alto Networks’ Unit 42 shows how legitimate remote-support software can be used as the first step.
What’s happening
Palo Alto Networks’ Unit 42 recently reported a campaign that uses fake Microsoft Store pages advertising popular video-conferencing apps. An employee who needs a meeting tool searches for it, lands on what looks like the official store page, and clicks install.
They don’t get a meeting app. They get a real, digitally signed copy of a remote-support tool like LogMeIn Resolve or ConnectWise ScreenConnect, the same software IT teams use every day. Windows shows its normal security prompt, the install finishes cleanly and nothing seems wrong.
The difference is that the tool is now connected to the attacker’s account.
After gaining access, the attackers use that remote connection to quietly install a second piece of malware called AgtaBackup. It runs as a hidden Windows SYSTEM service and hides its files behind names that look like Windows security components. From there it can:
- Steal saved passwords and login sessions from major web browsers
- Record keystrokes
- Take screenshots and move files
- Run commands on a hidden desktop that the user never sees
- Reinstall itself within about a minute if someone deletes it
Stolen browser credentials are a direct path into the accounts your business runs on, including Microsoft 365, email, CRM and finance platforms.
Why this is so hard to catch
The software is trusted. Remote-support tools are signed, widely used and often allowed by default, so antivirus tools may not flag them and their network traffic looks like normal IT support.
Familiar prompts can be misleading. The page imitates an official store, and the installer asks for a normal-looking Windows approval.
The attack happens in stages. The remote-support installation and the malware installation are separate steps, which can make the connection less obvious.
It hides from admins. The malware is configured so that even administrator accounts may not see it running.
How to fight back
1. Decide which remote tools you allow. Choose one approved remote-support tool and block the rest. If ScreenConnect turns up on a laptop and your IT provider doesn’t use it, that’s a red flag.
2. Control where software comes from. Employees shouldn’t be installing their own apps from search results. Use managed software deployment so approved tools are pushed centrally.
3. Watch for unexpected remote-tool enrollments. Monitor for remote-support software connecting to accounts or tenants you don’t own.
4. Stop saving passwords in browsers. Move your team to a business password manager and make phishing-resistant MFA mandatory on Microsoft 365 and other critical systems, so a stolen password alone isn’t enough.
5. Turn on PowerShell and endpoint logging. This attack depends on remote commands that quietly download and install software. Detection tools with good logging can catch that pattern even when the software involved is legitimate.
6. Update your security training. Teach people that “it came from an official-looking store” and “Windows asked me to approve it” are not signs that something is safe. When in doubt, ask IT before installing anything.
7. Get expert eyes on it. Most small and mid-sized businesses don’t have the staff to hunt for threats like this. A managed IT and security partner can monitor your environment, lock down your tools and respond quickly if something gets through.
Campaign details: Unit 42 campaign notes.
Join us live: October 22 at 11:00 AM ET
We’re hosting a webinar with our partners at CloudSource on threats like this one, including attacks aimed at Microsoft 365 environments. We’ll cover how these attacks get in, what warning signs to look for and practical steps any business can take.
Thursday, October 22 | 11:00 AM ET
About 40 to 45 minutes, with live Q&A.
Registration link: https://www.linkedin.com/events/7514331218809712640/
Bring your questions.
Work With Hawk Digital
Working through a similar problem? We help teams connect revenue strategy with the operational work needed to deliver it, across retail media, commerce, ad operations, and AI workflows.
We also support teams through:
- Managed Production Services. Social, short-form, long-form, and branded video, delivered by an outsourced team or a team embedded in your organization.
- Enterprise AI Command Center. Branded customer engagement and revenue intelligence, with Rosie as its retail media application. We’ll help define the channels, integrations, and human handoffs your use case needs.
- Broadstreet Daybreak. A free lead-generation tool that lets small publishers turn their readers into advertiser conversations.
Have a question? Book a Quick Call
The Hawk Digital team