According to BleepingComputer (1 September 2026), Huntress researchers say phishing actors abused the legitimate Faronics Deploy endpoint-management platform in activity observed between 21 July and 20 August 2026, with Faronics-themed lures disguised as invoices, tax documents or other business files reaching more than 457 endpoints.

BleepingComputer says victims were prompted to download and launch a legitimate, signed Faronics Deploy installer disguised as an Adobe document, reader app or plugin update, after which the attackers ran scripts through the platform, using curl or mshta to fetch more content or msiexec, to install ConnectWise ScreenConnect as a second remote-access channel.

Huntress notified Faronics on 5 August; according to BleepingComputer, Faronics confirmed the activity, added anti-abuse measures and contacted affected organisations, and Huntress says the activity dropped significantly from 21 August. Huntress recommends checking C:\ProgramData\Faronics\Logs\ for a ScriptRunner.log file and looking for ScreenConnect installations where it is not normally deployed.

Correction (25 Oct 2026): the card's facts are now attributed to BleepingComputer's report of Huntress's findings, and advice to email Faronics support, which that report does not contain, has been removed. (source: BleepingComputer)