Fake HR Desktop Apps Are Handing Attackers Remote Access — Does Your RMM Know What's Installed on Your Endpoints?

The Register recently reported on a campaign that should make every sysadmin and MSP tech sit up: criminals impersonating well-known HR and payroll providers contact employees — usually in HR — and talk them through installing a "desktop app" to fix an urgent payroll issue. The chain is polished end to end. Convincing emails, a clean installer, a friendly "support technician" on the phone.

The only suspicious thing about the entire attack is that none of the impersonated HR and payroll vendors actually offers a desktop application.

Staff install it anyway. Minutes later, the attacker has an interactive remote session on a corporate endpoint — inside your network, over a legitimate remote access tool, wearing the employee's own credentials.

Here's what should bother you, the person accountable for those endpoints: this attack needs no exploit, no zero-day, and no firewall misconfiguration. It needs an employee to run an installer — one of the most basic endpoint events your management stack should see, evaluate, and reverse. Most stacks can't, because the RMM only watches its own agent, the monitoring tool doesn't track software, and the helpdesk finds out when finance notices a missing paycheck.

The Problem in Depth

The attack chain is deliberately boring

1. An email or Teams message impersonates an HR/payroll vendor: "There's an issue with your direct deposit. Install our desktop app and our support agent will walk you through it."
2. The employee installs it. Urgency plus authority (payroll!) plus a plausible app — very few people question it.
3. The "app" is, or quietly bundles, a remote access tool: AnyDesk, ScreenConnect, TeamViewer, RustDesk — whatever the criminal likes that day.
4. The attacker connects, usually after hours. The session runs through a genuine, signed remote access application, so antivirus has no opinion about it.
5. From there: payroll diversion, mailbox rules for BEC, credential dumping, ransomware staging.

Every link in that chain is legitimate software doing legitimate things. That's why perimeter firewalls and signature-based AV are irrelevant here. The attack surface is your software inventory — or the absence of one.

What today's tooling actually sees

Your RMM manages its own agent — not the remote access ecosystem. ConnectWise (ScreenConnect), NinjaOne, Datto RMM, N-able: excellent at deploying and maintaining the agent you put on devices. But ask yourself honestly — if AnyDesk landed on a workstation in accounting at 16:52 on a Thursday, would your RMM tell you? For most teams, no. Unauthorized-software detection is a custom monitor someone was going to build "after the next project."

Standalone monitoring is blind to endpoint software. PRTG, Zabbix, Nagios watch services, ports, SNMP, bandwidth. Not one of them will surface a new remote access tool appearing on an endpoint.

The helpdesk hears about it last, if ever. When HR finally calls about the "weird app that popped up," the ticket has no link to what changed on the device or when — because the helpdesk doesn't share a data plane with anything.

Shadow remote access is already everywhere. Users install AnyDesk so a relative can "take a quick look." A printer vendor demands TeamViewer for "support." Every one of those installs is a fully functional, unlogged, unmonitored remote session capability sitting on your network — exactly what the criminals are social-engineering onto endpoints.

What it actually costs

• Dwell time measured in days. Realistic timeline: installer runs Friday 17:40. Attacker connects at 23:00. Payroll gets diverted. The tool is quietly uninstalled Sunday night. The employee reports a missing deposit Monday. That's roughly 60 hours of access, and because nothing logged the install, the session, or the removal, your incident response starts with "we don't actually know."
• Forensics without data. "What did they touch?" means pulling disks, because no correlated record exists anywhere.
• The MSP multiplier. One client endpoint compromised through a remote access tool you didn't know existed means incident response on that account, an awkward cyber insurance conversation, and a renewal you might lose.
• Technician burnout by a thousand tickets. Without inventory and change visibility, every "my computer is acting weird" ticket becomes a manual RDP-and-eyeball investigation that leaves no record for the next tech.

IBM's Cost of a Data Breach puts the average incident near $4.9M, and the FBI's IC3 has flagged payroll diversion and remote-access-enabled BEC as billion-dollar fraud categories for years. You don't need the averages, though. You need to know — right now — which remote access tools exist on the endpoints you're accountable for. That's an inventory question, and inventory is an RMM question.

How AlertMonitor Closes the Gap

AlertMonitor runs infrastructure monitoring, RMM, helpdesk, patching, and network topology on one agent and one console. That unified architecture is precisely what this attack exposes as missing elsewhere.

1. Continuous software inventory on every managed endpoint. The agent collects installed applications and hardware details continuously. Search "AnyDesk" once and you see every device running it — across every client, if you're an MSP — in seconds instead of after a week of RDP marathons.

2. Alerts on new and unauthorized software. Define a policy: these remote access applications are approved (your own RMM agent first), and anything else in that class raises an alert the moment it appears. The alert lands in the same queue as your disk and service alerts, with device, user, and timestamp attached.

3. Scripted remediation at scale, with results in the timeline. Push an audit or cleanup script to a device group from the same console you monitor from. Script output and exit codes feed back into the monitoring data, so the uninstall becomes a documented event on that device's timeline — visible to every tech who touches it next. No tab-switching, no second tool.

4. Remote sessions with a real audit trail. Technician sessions through AlertMonitor's RMM are logged — who connected, to what, for how long — and tie directly to the helpdesk ticket they belong to. Compare that to a shadow AnyDesk install, which leaves nothing at all.

5. Patch management that closes the follow-up door. Attackers who land via social engineering routinely chain into known privilege escalation bugs on unpatched endpoints. AlertMonitor's patch compliance is per-endpoint and per-client, so "we were patched" is a report you can actually produce.

The workflow, before and after

Fragmented stack: user reports a weird app → ticket in the helpdesk → tech RDPs in (or walks over) → scrolls through installed programs → maybe finds it → uninstalls by hand → types something in the ticket → no other system ever learns this happened. Elapsed: hours to days. Record: one text field.

AlertMonitor: policy alert fires on unauthorized install → tech opens the device straight from the alert → device view shows the exact install event → Run Script → cleanup executes → uninstall confirmed in the timeline → ticket linked automatically → close. Elapsed: minutes. Record: complete and permanent.

Detection time drops from "whenever a human notices" to the moment the installer finishes. That difference is the difference between a cleanup task and a breach disclosure.

Practical Steps You Can Take Today

1. Audit every endpoint for unauthorized remote access tools

This PowerShell check reads the uninstall registry keys, flags known remote access software that isn't approved, and exits non-zero when it finds something — which means that when run through AlertMonitor's script runner, a hit raises a failed check you can alert on:

# Audit an endpoint for remote access software that isn't on the approved list
$approved = 'AlertMonitor'   # your own RMM agent + anything business-approved
$suspect  = 'AnyDesk','TeamViewer','ScreenConnect','ConnectWise Control',
            'Splashtop','TightVNC','RealVNC','UltraVNC','TigerVNC','RustDesk',
            'LogMeIn','GoToMyPC','Ammyy','Supremo','MeshAgent','Zoho Assist','Remotely'

$keys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$found = Get-ItemProperty $keys -ErrorAction SilentlyContinue |
    Where-Object {
        $dn = $_.DisplayName
        ($suspect  | Where-Object { $dn -like "*$_*" }) -and
        -not ($approved | Where-Object { $dn -like "*$_*" })
    }

if ($found) {
    $found | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate |
        Format-Table -AutoSize
    exit 1   # non-zero exit = failed check = alert raised in AlertMonitor
}
else {
    Write-Output "OK - no unauthorized remote access software on $env:COMPUTERNAME"
    exit 0
}

In AlertMonitor: Devices → select your device group → Run Script, paste, execute. Per-device results land in each endpoint's timeline. Schedule it weekly and this stops being a one-off audit and becomes a continuous control.

2. Remove what you find — centrally, not desk by desk

# Silently remove AnyDesk (standard per-machine install)
$app = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
                        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
    Where-Object { $_.DisplayName -like 'AnyDesk*' }

if ($app) {
    if ($app.QuietUninstallString) {
        cmd /c $app.QuietUninstallString
    }
    elseif ($app.UninstallString) {
        $uninst = ($app.UninstallString -replace '"', '') + ' /S'
        cmd /c $uninst
    }
}

# Kill lingering processes and sweep leftovers
Stop-Process -Name 'AnyDesk' -Force -ErrorAction SilentlyContinue
Remove-Item "$env:ProgramData\AnyDesk" -Recurse -Force -ErrorAction SilentlyContinue
Write-Output "AnyDesk removal complete on $env:COMPUTERNAME"

Same workflow: select the affected devices in AlertMonitor, run the script, and confirm the removal in each device's timeline.

3. Don't forget your Linux fleet

Remote access tools exist there too, and they're just as invisible to a Windows-centric stack:

# List enabled remote access services on a Linux endpoint
systemctl list-unit-files --type=service --state=enabled | \
  grep -Ei 'anydesk|teamviewer|rustdesk|vnc|meshagent|screenconnect'

# Show remote access processes currently listening
ss -tulpn | grep -Ei 'anydesk|rustdesk|vnc|teamviewer'

4. Check who has local admin

The fake-app attack lands hardest where users can install anything they like:

# Who holds local admin on this machine? Least-privilege review
Get-LocalGroupMember -Group 'Administrators' |
    Select-Object Name, ObjectClass, PrincipalSource |
    Format-Table -AutoSize

Run it fleet-wide, and pull admin from everyone who doesn't demonstrably need it. This one script tells you how much of your environment is exposed to exactly this class of attack.

5. Hold your own remote access to the same standard

You now alert on rogue remote tools — apply the same rigor to your own: MFA on every technician account, source restrictions on inbound RMM traffic, and a monthly review of the remote session log in AlertMonitor. Every session should map to a ticket or a documented change. If it doesn't, that's a finding.

6. Give end users one rule

HR and payroll vendors do not ship desktop apps. Support happens through the portal employees already log into — never through an installer someone sent them. One sentence, repeated at onboarding and in quarterly training, prevents more incidents than most products you could buy this year.

Bottom Line

The fake HR app campaign works because it weaponizes the one capability IT teams deploy everywhere but rarely govern: remote access. You can't govern what you can't see. With software inventory, install alerts, scripted remediation, and audited sessions living in one platform instead of four, remote access stops being your biggest blind spot and becomes your best-documented process — and the next fake "support app" gets flagged, removed, and ticketed before the attacker ever connects.

Related Resources

AlertMonitor RMM & Remote Management AlertMonitor Platform Overview Book a Demo RMM & Remote Management Resources