# Bank of America Phishing Email Delivers ScreenConnect Malware

Bank of America-themed phishing page delivers a VBS that chains base64/AES stages to install ScreenConnect RMM with a UAC bypass, giving attackers remote control.

- Payout: Real-world hack
- Severity: high
- Program: Bank of America
- Analysis by: Huntress
- Disclosed: 2026-08-04
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/bank-spam-rmm
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-bank-spam-rmm
- Tags: area:os domain:desktop impact:internal-access impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:chained vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows endpoint via phishing page and VBS/PowerShell loader
**Root cause:** A phishing page serves AccountGuardSetup.zip containing AccountGuardSetup.vbs; the VBS runs nested base64-encoded PowerShell stages that download a ScreenConnect MSI and decrypt AES-128-CBC blobs (key stored in plaintext) containing a C# ICMLuaUtil COM UAC bypass and an SDDL/ACL hardening script.
**Steps:**
1. Victim on Windows User-Agent visits `hxxps://sectioncompil[.]com/wkudpl/windows/manage.html` and clicks "Update My Information"
2. Downloads `AccountGuardSetup.zip` containing `AccountGuardSetup.vbs`; running it decodes base64 to a PowerShell script in My Documents and executes it after a delay
3. Nested base64 layers decode to a final PowerShell script that downloads `hxxps://cdn.uploadtourl[.]com/3b154d8e-61be-4521-b3c3-75efb845a2e2_msi_base64.txt`, decodes it to a 17MB ScreenConnect MSI written to `%localappdata%\Microsoft\sc.msi`
4. Script AES-128-CBC decrypts two embedded hex blobs using plaintext `$key` and first 16 bytes of each blob as IV
5. First blob is C# code compiled and run to invoke ICMLuaUtil COM UAC bypass (T1548.002), installing sc.msi as Administrator under service name `Windows Security`
6. Second blob is a VBScript that deletes the ScreenConnect registry key, hides it from installed apps, and applies SDDL/ACLs to block changes and hide `C:\ProgramData\Windows Security`
7. Parent PowerShell deletes both scripts; host connects to `217.60.195[.]167:8041/tcp` awaiting operator
**How found:** Huntress received the malspam in a spamtrap account on July 28 and triaged the multi-stage loader, peeling nested base64 layers and AES blobs to reveal the ScreenConnect installer and UAC bypass.
**Exploitation:** Phishing email from spoofed `bkofamerica[.]com` redirects via `kleinschnitg[.]com` to a Bank of America-lookalike page; Windows visitors get a malware download, Mac visitors get a credential/PII harvesting form. Executing the VBS silently installs ScreenConnect RMM with admin rights via UAC bypass, then beacons to attacker C2 for hands-on-keyboard access.
**Escalation:** UAC bypass elevates to Administrator for silent install; SDDL/ACL manipulation hides and protects the service from removal, complicating remediation.
**Insight:** Nested base64 plus AES blobs with the key stored inline are a common evasion pattern; when triaging a VBS/PowerShell loader, follow each decode layer and check for plaintext `$key` variables and IV-prefixed hex blobs to reach the final payload quickly.

## Proof of concept (copied exactly from the original report)

**Malware delivery URL for AccountGuardSetup.zip**

```
hxxps://sectioncompil[.]com/wkudpl/windows/download/AccountGuardSetup.zip
```

**Base64 ScreenConnect download URL**

```
hxxps://cdn.uploadtourl[.]com/3b154d8e-61be-4521-b3c3-75efb845a2e2_msi_base64.txt
```

**Phishing link in email**

```
hxxps://kleinschnitg[.]com/F3bebOag/?id=email
```