Bad actors are abusing Faronics Deploy in phishing campaigns to run PowerShell, deploy ScreenConnect, and evade detection by using trusted tools.

A threat actor got in through SonicWall, then found a plaintext password file sitting on someone's desktop. This companion post to the SonicWall advisory is a cautionary tale in one screenshot.

A large wave of PowerShell malware hit on a Friday afternoon and Huntress analysts dove in immediately. What they found was a Warzone RAT infection chain that tested their detectors in real time.