[AnyDesk TAG] AnyDesk and ScreenConnect in a campaign targeting banking customers

AnyDesk and ScreenConnect in a Campaign Targeting Banking Customers

Last week at VulnCheck's ThreatCon1 conference we briefly touched on a campaign we have been tracking since early spring. It was one of several examples in a talk about looking outward for adversary infrastructure rather than waiting for an attack to arrive.

This one is not an Adversary-in-the-Middle campaign. It is a phone-led fraud operation targeting banking customers, and it has been running since at least March 2026. The operator uses convincing copies of bank support pages, genuine remote-access software and custom signed payloads to gain remote access to victims' computers.

By October we had linked at least 383 registered domains to the campaign or its supporting infrastructure. We have seen targeting of both consumers and businesses, with lures impersonating organisations including Allica Bank, Revolut, Barclays, Lloyds, Wise, Santander, NatWest Bankline, HSBC, Arbuthnot Latham, Weatherbys, C. Hoare & Co, Standard Bank, ANZ and NAB, among others.

We refer to the activity internally as AnyDesk TAG.

This post is the TLP:CLEAR version of the research. We are deliberately keeping some of the more useful tracking pivots, current infrastructure and collection methods out of the public write-up as this campaign is still active and we'd prefer not to share a "how to do better opsec" guide with those behind the campaign. A more detailed TLP:AMBER advisory is available to defenders who can handle it appropriately; details are at the end of this post.

The website is part of the social engineering

The victim is directed to a cloned bank help or support site while speaking to someone claiming to represent their bank or fraud team. We have not established how the telephone interaction is initiated, so we are deliberately not describing the campaign as callback phishing or TOAD.

The copied sites are convincing. The interesting part is what has been added to them.

Figure 1: A cloned Barclays page with operator-added support controls. Visible indicators have been defanged.

Depending on the version of the kit, the page presents buttons such as:

• Verify Call
• Live Chat
• Generate Case ID
• Security Check
• Fraud Report

Selecting one of those options asks the victim for a verification code supplied by the person on the phone. Once the server accepts the code, it returns a download and the victim can be talked through running it.

The website is therefore doing more than simply pretending to be a bank. It gives the telephone conversation a process: a verification step, a case ID, a fraud report or a support tool. Each makes the person on the phone feel more like part of a real bank workflow.

The live support variants we observed did not collect online-banking credentials directly. We did, however, find a staging version of the wider kit that included username and password fields, so credential-phishing functionality existed within the same broader infrastructure.

From AnyDesk to persistent ScreenConnect access

The Live Chat option delivered the genuine AnyDesk installer from AnyDesk's own infrastructure. There is nothing malicious about that file. The abuse is in the context around it. A victim who believes they are speaking to their bank is instructed to install a legitimate remote-support product and grant access.

Other buttons went considerably further.

The Verify Call route delivered a file named verify_call.exe. The sample we recovered presented itself as "ShieldWall Defender" from "SilverPeak Software", but static analysis showed that it contained a ScreenConnect installer and code intended to elevate privileges. It also attempted to disable or weaken a range of Microsoft Defender and SmartScreen controls before installing ScreenConnect.

A separate route delivered FraudReport.zip. That archive used a genuine Microsoft Defender component alongside a malicious mpclient.dll, allowing the attacker-controlled DLL to be loaded by trusted Microsoft-signed software. The archive also contained an encoded copy of the same ScreenConnect MSI and a genuine Action Fraud leaflet used as a decoy.

The result of both chains was the same: ScreenConnect configured for unattended access.

Once the unattended ScreenConnect service is installed, access no longer depends requires the original phone call still being in progress - an important distinction from a one-off AnyDesk session.

Trusted Tooling

One of the recurring themes in the campaign is the use of things that already look trustworthy.

We recovered:

• the genuine AnyDesk installer;
• a genuine Microsoft Defender executable used in a DLL side-loading chain;
• a genuine Proton AG-signed launcher inside another delivery archive;
• a genuine Action Fraud document used as a decoy;
• two malicious files carrying valid EV Authenticode signatures.

The two malicious signed components used certificates identifying Botania Games in Japan:

We cryptographically verified the signatures and reported both certificates to their respective certificate authorities on 9 October 2026.

Both certificates have since been revoked.

Validly signed software is not the same thing as safe software. In this case the signatures gave malicious files a named publisher and a legitimate signature chain while the payloads themselves were being used to install remote access.

We do not know the role of the certificate holder. The available evidence does not establish whether the organisation knowingly participated, had signing material compromised, or had its identity used in some other way. The reason for publishing the certificate information is to identify the signed malware, not to attribute the campaign to the named company.

The campaign kept changing

We have watched the operation evolve over several months.

Early versions used comparatively simple pages and a shared verification mechanism. Later versions added stronger code handling, lockouts, encrypted page content, browser checks and eventually a cookie gate followed by multiple encrypted and randomised layers.

Payload delivery also changed. Some of the May samples were delivered through public file-sharing services (another case of utilising "trusted" infrastructure); later versions moved delivery onto infrastructure controlled by the campaign.

The DNS and hosting changed too. We observed several generations of infrastructure and continued to see new bank-themed domains through October 2026.

It is easy to look at an individual phishing site or malware sample and treat it as disposable. The individual artefacts are disposable. The operation behind them is not, the way the infrastructure is joined up takes time and effort to achieve.

By October we had linked 383 registered domains to the activity or its supporting infrastructure. Only part of that set was ever directly observed as victim-facing lure sites; the rest came from the wider infrastructure around the campaign. We are not publishing the full domain corpus here because some of those relationships remain useful for tracking the operation.

Selected public indicators

We are publishing a small number of historical and immutable artefacts so that organisations searching for samples from this activity can connect them back to the campaign. This is not the full indicator set and should not be treated as a current blocklist.

Malware and payload hashes

Revoked code-signing certificates

Selected historical lure domains

helpwithrevolut[.]com
revolutreportfraud[.]com
barclaysreportfraud[.]com
allicabankhelpdesk[.]com
wiseverifycall[.]com
banklinereportfraud[.]com
supportwithlloyds[.]com
hoaresbanking[.]com

These are deliberately a small subset of the campaign. We are withholding the current infrastructure relationships and the complete domain set from the public post.

Selected infrastructure

46.151.182[.]138   early lure/staging infrastructure
46.151.182[.]146   second-generation lure infrastructure
31.7.61[.]48       later authoritative DNS and lure infrastructure
179.43.175[.]13    later campaign lure/infrastructure host

Similar activity

The closest public reporting we have found is Silent Push's August 2024 research into a UK banks AnyDesk social engineering campaign.

The approach is strikingly similar: cloned banking support/live-chat pages, legitimate AnyDesk delivery and overlap in targeted bank brands. The infrastructure and web kit we observed are different and we have found no technical artefact that directly connects the two operations.

It is possible that the activity described here represents an evolution of the same underlying fraud model, but we do not currently have enough evidence to establish continuity between them.

There is also broader public reporting on fake live-support sites and on signed malware delivering remote-management tooling, but we have not found another publication that ties together this campaign's landing kit, infrastructure, payloads and signing certificates.

What we are not publishing

There is considerably more behind this investigation than we feel appropriate to put on the public internet.

This TLP:CLEAR post intentionally leaves out:

• the campaign's current authoritative-DNS and hosting pivots;
• the full domain and infrastructure set;
• operator panels and backend infrastructure;
• weaknesses in the infrastructure that were useful during collection;
• details of how verification codes and payload locations were recovered;
• some current ScreenConnect and infrastructure identifiers;
• several tracking techniques that continue to provide useful visibility.

Publishing those details would mostly tell the operator which parts of their infrastructure defenders are using to follow them.

The purpose of this post is different: document the campaign publicly, provide enough information for defenders to recognise it, and establish a reference point for the research without burning the parts that are still useful.

Getting the TLP:AMBER advisory

We have produced a substantially more detailed TLP:AMBER advisory containing the wider indicator set, infrastructure analysis, malware detail, tracking opportunities and supporting evidence.

If you work in financial services, provide security services to organisations that may be affected, or otherwise have a legitimate defensive need for the additional material and can handle TLP:AMBER appropriately, email:

advisory+anydesktag2610@lab539.com

Please include your organisation and role so we know where the advisory is going.

A broader point

Although this is not an AiTM campaign, the research approach is very similar to the work behind AiTM Feed.

Most defensive technology is designed to become useful once an attack reaches the organisation: detect the login, detect the malware, detect the remote-access tool, then respond quickly.

That work matters, but adversaries do not start at the point we first see them in our environment. They spend time registering domains, building infrastructure, configuring services, testing payloads and changing things when defenders interfere.

There is useful defensive work to be done out there too.

AiTM Feed is built around that idea: finding and operationalising adversary infrastructure early enough that defenders can do something about it before an incident begins.