> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Bank of America impersonators weaponize ScreenConnect, then make it hard to remove - URL: https://f4n6.co.uk/security-feed/bank-of-america-impersonators-weaponize-screenconnect-then-make-it-hard-to-remove/ - Published: 2026-08-05T10:30:58.000Z - Updated: 2026-08-05T10:30:58.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary An active phishing campaign impersonating Bank of America (BoA) is delivering a weaponised ScreenConnect RMM client to Windows users via a multi-stage VBS/PowerShell chain. The malware installs a hidden remote-access service named "Windows Security," uses a UAC bypass for silent privilege escalation, and applies SDDL ACLs to prevent detection and removal via standard Windows tooling. No CVEs are exploited in the ScreenConnect product itself; the campaign abuses legitimate RMM functionality for persistent remote access. EMEA financial services clients should treat this as a credential-theft and remote-access risk to retail and corporate customers who may bank with BoA, and should brief fraud and SOC teams on the indicators below. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | The campaign delivers hidden RMM persistence on endpoint devices, which — if a staff member or contractor is compromised — constitutes an ICT-related incident requiring detection, containment, and recovery procedures. | Ensure incident runbooks cover RMM-based persistence and SDDL/ACL-based concealment; verify EDR and SOC playbooks include "Windows Security" service-name blending. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | A successful compromise grants unrestricted remote access via a hidden service, potentially meeting "major" severity thresholds depending on data access and system impact. | Pre-classify this scenario in your incident severity matrix so SOC escalation is not delayed by the absence of traditional malware signatures. | No NIS2 or UK NIS article is specifically engaged beyond generic incident-response obligations; the trigger facts here are not distinctive to those regulations. ## 3\. Technical analysis & attack chain **Attribution note:** No named threat actor is identified in the source material. Attribution is unconfirmed. All technical detail below is single-sourced (Huntress analysis via Help Net Security); verify before enforcement. ### Attack chain (confirmed from source) 1. **Phishing email** — Sender address `onlinebanking@ealerts[.]bkofamerica[.]com` impersonates BoA e-alerts. Lure: "avoid account restrictions." Broad blast (confirmed via Huntress honeytrap account). 2. **User redirection (platform-dependent):** \- **Mac users** → BoA lookalike login page → credential harvest → secondary form collecting personal and financial information. - **Windows users** → BoA lookalike page → "Update My Information" button → downloads `AccountGuardSetup.zip`. 3. **Zip extraction and execution** — User unzips and runs `AccountGuardSetup.vbs`. 4. **VBS stage** — Contains embedded base64-encoded data blobs. Decoding triggers successive PowerShell scripts, each calling the next. 5. **Final PowerShell stage** — Downloads an encoded `sc.msi` file from UploadToURL.com. Writes to `%localappdata%\Microsoft\`. Decrypts two additional embedded data blobs. 6. **UAC bypass and install** — First blob: public UAC bypass exploit. Used to install `sc.msi` (ScreenConnect client) with Administrator privileges, no user prompt. 7. **Service registration** — ScreenConnect registers as a Windows service named **"Windows Security"** (blends with legitimate Windows services). 8. **Concealment and anti-removal** — Second blob (AES-encrypted) decrypts to a VBScript that: - Deletes the registry key pointing to the ScreenConnect installer. - Prevents ScreenConnect from appearing in the installed-apps list or being uninstalled normally. - Uses SDDL and ACLs to block the user from making changes and to hide the ScreenConnect process. 9. **Cleanup of artefacts** — Parent PowerShell script deletes both scripts. 10. **C2 connectivity** — ScreenConnect client connects to attacker-controlled relay. C2 IP geolocates to the United Arab Emirates; reputationally challenged — multiple other malware families reportedly use the same address. **Persistence mechanism:** Windows service "Windows Security" with SDDL/ACL restrictions preventing modification, query, or termination via `services.msc`, `Get-Service`, or `sc.exe query`. **Impact:** Unrestricted remote access to the compromised host. Credential theft (Mac path). Potential for follow-on financial fraud, data exfiltration, or lateral movement if the endpoint has corporate network access. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Email blocking:** Block sender domain `ealerts[.]bkofamerica[.]com` at mail gateway. Note: legitimate BoA e-alerts originate from `ealerts.bankofamerica.com` — the spoofed domain uses `bkofamerica` (missing "an"). - **URL blocking:** Block `kleinschnitg[.]com` and `sectioncompil[.]com` (phishing landing pages) at web proxy / DNS sinkhole. - **File blocking:** Block `AccountGuardSetup.zip` and `AccountGuardSetup.vbs` at email gateway and web proxy. Create EDR file-name rules for both. - **EDR hunt:** Search endpoints for: - Service named "Windows Security" (note: legitimate Windows services use "Windows Security Center" / "wscsvc" — "Windows Security" as a display name is anomalous). - Files in `%localappdata%\Microsoft\` named `sc.msi`. - VBS files containing large base64 blobs. - PowerShell processes spawning from `wscript.exe` / `cscript.exe`. ### P2 — Within 72 hours - **Containment procedure for confirmed infections:** 1\. Isolate host from network immediately. 2\. Do NOT attempt removal via `services.msc`, `Get-Service`, or `sc.exe` — the SDDL ACLs prevent these tools from listing the service. 3\. Boot to Safe Mode or use WinPE. Remove SDDL restrictions on the service via `sc.exe sdset "Windows Security" D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;IU)` from an elevated SYSTEM context (e.g., PsExec -s). 4\. Delete the service: `sc.exe delete "Windows Security"`. 5\. Remove `sc.msi` from `%localappdata%\Microsoft\`. 6\. Check registry for deleted installer keys under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` and `HKLM\SYSTEM\CurrentControlSet\Services`. 7\. Reimage recommended if any doubt about follow-on activity. - **Network IOC:** Investigate any outbound connections to UploadToURL.com from corporate endpoints. Block at proxy/firewall. - **C2 IP:** The UAE-geolocated C2 IP is not specified numerically in the source. Query threat-intel feeds for ScreenConnect relay IPs with poor reputation flagged for multiple malware families. Single-sourced — verify before blocking. ### P3 — Within 7 days - **User awareness:** Brief staff on BoA impersonation lures; the "Account Guard" brand is not a legitimate BoA product. - **RMM policy:** Review and enforce allow-listing for RMM tools (ScreenConnect, AnyDesk, TeamViewer, etc.) via EDR application control. Legitimate RMM use should be inventoried and monitored. - **Callback verification:** For any customer-facing fraud team, reinforce callback verification for account changes initiated via email links. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------------ | --------------------------------------------- | ---------- | ------------------------------ | | Email sender | onlinebanking@ealerts\[.\]bkofamerica\[.\]com | High | Huntress via Help Net Security | | Domain | kleinschnitg\[.\]com | High | Huntress via Help Net Security | | Domain | sectioncompil\[.\]com | High | Huntress via Help Net Security | | Domain | UploadToURL.com | High | Huntress via Help Net Security | | Filename | AccountGuardSetup.zip | High | Huntress via Help Net Security | | Filename | AccountGuardSetup.vbs | High | Huntress via Help Net Security | | Filename | sc.msi | High | Huntress via Help Net Security | | File path | %localappdata%\\Microsoft\\sc.msi | High | Huntress via Help Net Security | | Service name | Windows Security | High | Huntress via Help Net Security | ```iocs email onlinebanking@ealerts[.]bkofamerica[.]com domain kleinschnitg[.]com domain sectioncompil[.]com domain UploadToURL.com filename AccountGuardSetup.zip filename AccountGuardSetup.vbs filename sc.msi filepath %localappdata%\Microsoft\sc.msi servicename Windows Security ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ---------- | | wscript.exe executing AccountGuardSetup.vbs followed by chained PowerShell child processes | EDR process tree / Sysmon Event ID 1 | High | | PowerShell downloading MSI from UploadToURL.com | Proxy logs / Sysmon Event ID 22 (DNS) / Event ID 3 (network) | High | | Windows service named "Windows Security" not visible via sc.exe query or Get-Service due to SDDL ACL restrictions | EDR service enumeration / sc.exe query returns nothing but service exists in registry | High | | ScreenConnect client installed but absent from "Programs and Features" / installed-apps list | HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall missing expected entry | High | | VBS scripts self-deleting after execution | EDR file deletion events / Sysmon Event ID 23 | Medium | ## 6\. Detection ```yara rule BoA_ScreenConnect_AccountGuard_Installer { meta: author = "Adverse Trace" date = "2026-08-05" reference = "https://www.helpnetsecurity.com/2026/08/05/fake-bank-of-america-email-account-guard/" description = "Detects AccountGuard VBS installer delivering ScreenConnect RMM in BoA impersonation campaign" strings: $vbs_name = "AccountGuardSetup.vbs" nocase $msi_name = "sc.msi" nocase $msi_path = "%localappdata%\\Microsoft\\" nocase $service_name = "Windows Security" nocase $upload_domain = "UploadToURL.com" nocase $blob_marker = "base64" nocase condition: 3 of them } ``` ```yaml title: Suspicious Service Named Windows Security - Potential ScreenConnect RMM Persistence id: 7a3c1f2e-8b5d-4e6a-9c0f-1d2e3f4a5b6c status: experimental description: > Detects a Windows service registered with the display name "Windows Security", consistent with the BoA impersonation campaign delivering hidden ScreenConnect RMM. Legitimate Windows security services use "Windows Security Center" (wscsvc), not "Windows Security" as a standalone display name. author: Adverse Trace date: 2026/08/05 references: - https://www.helpnetsecurity.com/2026/08/05/fake-bank-of-america-email-account-guard/ logsource: product: windows service: system detection: service_creation: EventID: 7045 filter_legitimate: ServiceName|startswith: - "wscsvc" - "SecurityHealthService" condition: service_creation and not filter_legitimate fields: - ServiceName - ServiceFileName - ServiceType falsepositives: - Custom legitimate services named "Windows Security" (unlikely; verify) level: high ``` ```yaml title: VBS to PowerShell Chain Downloading MSI from UploadToURL.com id: 8b4d2g3f-9c6e-5f7b-0d1a-2e3f4a5b6c7d status: experimental description: > Detects wscript/cscript executing a VBS file followed by PowerShell downloading an MSI from UploadToURL.com, consistent with the AccountGuard ScreenConnect delivery chain. author: Adverse Trace date: 2026/08/05 references: - https://www.helpnetsecurity.com/2026/08/05/fake-bank-of-america-email-account-guard/ logsource: product: windows category: process_creation detection: vbs_execution: Image|endswith: - "wscript.exe" - "cscript.exe" CommandLine|contains: - "AccountGuardSetup.vbs" ps_child: ParentImage|endswith: - "wscript.exe" - "cscript.exe" Image|endswith: - "powershell.exe" - "pwsh.exe" CommandLine|contains: - "UploadToURL.com" - "sc.msi" condition: vbs_execution or ps_child falsepositives: - None expected level: critical ``` ## 7\. Sources - Help Net Security — "Bank of America impersonators weaponize ScreenConnect, then make it hard to remove" — https://www.helpnetsecurity.com/2026/08/05/fake-bank-of-america-email-account-guard/ — 2026-08-05 ## 8\. Adverse Trace position **Severity: High.** This campaign combines credible brand impersonation with a technically sophisticated delivery chain — UAC bypass, SDDL-based anti-removal, and legitimate RMM abuse for persistence — making it effective against non-technical users and difficult to remediate with standard Windows tooling. No CVE is involved; the risk is operational, not patch-related. Attribution is unconfirmed and all technical detail is single-sourced to Huntress. EMEA financial services clients should block the listed IOCs at email and web gateways immediately, hunt for the "Windows Security" service name across their estate, and ensure incident runbooks cover SDDL-restricted service removal. We will update this advisory if the C2 IP address, additional phishing domains, or actor attribution emerges from corroborating sources. --- [Read the original source →](https://www.helpnetsecurity.com/2026/08/05/fake-bank-of-america-email-account-guard/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*