This threat involves a sophisticated phishing campaign targeting Windows users with fraudulent Bank of America-branded emails. The emails direct victims to fake security pages and deliver a malicious AccountGuard.zip file containing a VBS script with multiple layers of base64-encoded content. The attack chain includes complex decoding scripts and exploits the ICMLuaUtil COM interface to bypass User Account Control (UAC) and install ScreenConnect remote monitoring software with administrator privileges. Additional components use Security Descriptor Definition Language (SDDL) and Access Control Lists (ACLs) to conceal the installation, prevent uninstallation, and hide the malicious service. The installed ScreenConnect client connects to command-and-control infrastructure in the UAE. Mac users are targeted differently, receiving credential phishing pages requesting banking credentials and personal information rather than malware.

The campaign enables attackers to install ScreenConnect malware with elevated privileges on Windows systems, allowing persistent remote access and control. The malware's use of UAC bypass and hiding techniques complicates detection and removal. The connection to command-and-control infrastructure in the UAE facilitates ongoing attacker control. Mac users face credential theft risks through phishing pages. Overall, the campaign risks unauthorized access, credential compromise, and potential further exploitation of infected systems.

No official patch or fix is available as this is a phishing campaign delivering malware rather than a software vulnerability. Mitigation focuses on user awareness to recognize fraudulent Bank of America emails and avoid opening suspicious attachments such as AccountGuard.zip. Organizations should block known malicious domains, URLs, and IP addresses associated with this campaign. Endpoint detection and response tools should be tuned to detect ScreenConnect installations via UAC bypass and obfuscation techniques. Mac users should be warned about credential phishing attempts. Regular user education and phishing simulations are recommended to reduce successful infections.