# Daisy-Chaining Trust: Investigating Faronics Deploy Abuse

Phishing lures trick victims into installing signed Faronics Deploy, enrolling endpoints in attacker-controlled deployments that push PowerShell to install ScreenConnect.

- Payout: Real-world hack
- Severity: high
- Program: Faronics Deploy
- Analysis by: Huntress
- Disclosed: 2026-08-31
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/faronics-deploy-abuse
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-faronics-deploy-abuse
- Tags: area:os domain:desktop impact:internal-access impact:rce kind:incident platform:threat-intel sev:high tech:payment tech:windows technique:chained vuln:misconfiguration

**Target:** Endpoint management agent (Faronics Deploy) on Windows endpoints
**Root cause:** Legitimate Faronics Deploy installer, run with admin rights, enrolls the endpoint into an attacker-controlled deployment; the agent's legitimate script-deployment function then executes attacker PowerShell without further victim interaction.
**Steps:**
1. Victim clicks phishing link (tax/invoice/document themes) to `fileportals.gytgtecg[.]xyz/index.php?verified=1` which fingerprints User-Agent, platform, resolution, timezone, language, touch, color depth to gate victims vs. decoys.
2. Victim is served a fake Adobe/Zoom/DocuSign download flow and downloads a Faronics-signed executable disguised as a document (e.g. `Adobe.exe`, `Invoice_89940.exe`).
3. Victim runs the installer with admin privileges; endpoint enrolls into attacker's Faronics deployment via `https://deploy.faronics[.]com/api/GetConfigSettings?ck=...&wid=...&cnfid=1`.
4. Attacker uses Faronics deployment to remotely execute PowerShell that fetches scripts from GitHub (`https://raw.githubusercontent[.]com/askaboutme121/Xusyahfd/refs/heads/main/Jhinstaller.ps1`) via curl/mshta/msiexec.
5. Scripts install ScreenConnect, establishing secondary remote access.
**How found:** Huntress observed a surge of Faronics-related lures across 457+ endpoints, analyzed the phishing domain and found visitor-based cloaking (benign Eastern Bank decoy, mobile denied.html), then traced the signed installer to attacker-controlled deployment and ScriptRunner.log artifacts.
**Exploitation:** Phishing delivers a signed Faronics installer run as admin; enrollment hands remote script execution to the attacker, who pushes PowerShell to pull staged payloads and install ScreenConnect for persistent RMM access.
**Escalation:** Daisy-chains a trusted signed RMM/deployment tool into a second RMM (ScreenConnect) to blend with legitimate business workflows and evade hash-based detection.
**Insight:** Abused RMM/deployment tools leave enrollment identifiers (the `ck` customer/deployment GUID in GetConfigSettings requests) and `ScriptRunner.log` remote-script URLs — pivot on these to cluster attacker deployments and infrastructure instead of volatile hashes.

## Proof of concept (copied exactly from the original report)

**ScriptRunner.log entry showing remote PowerShell script URL**

```
[ 2026 10:53: 6] Entered GetScriptNameUsingURL URL=https://raw.githubusercontent[.]com/askaboutme121/Xusyahfd/refs/heads/main/Jhinstaller.ps1
[ 2026 10:53: 7] Leaving GetScriptNameUsingURL ScriptName=Jhinstaller.ps1
```

**Faronics GetConfigSettings request exposing ck deployment identifier**

```
https://deploy.faronics[.]com/api/GetConfigSettings?ck=6D70CDEF-CFF4-48A7-8092-24E5B9C3FA1D&wid={00000000-0000-0000-0000-C45AB1DED776}&cnfid=1
```

**Fingerprint POST endpoint for visitor cloaking**

```
fileportals.gytgtecg[.]xyz/index.php?verified=1
```