Bank of America Phishing Email Delivers ScreenConnect Malware

What it is

A live Bank of America–themed phishing campaign observed by Huntress on July 28, in a spamtrap account. The lure email spoofs sender onlinebanking@ealerts[.]bkofamerica[.]com and warns the recipient has ~two weeks to "confirm" account information "to act quickly to avoid account restrictions." The embedded link is a redirect to a page mimicking Bank of America's branding. The summary covers the Windows RMM payload chain; what it omits is the OS-based branching, the specific IOCs, and the second (credential-theft) path.

How it works

The phishing page fingerprints the victim by User-Agent and splits:

flowchart TD
    A[Redirect link in email] --> B{User-Agent}
    B -->|Mac / non-Windows| C[Credential + PII harvest page]
    C --> C2[Username/password x2, name, address,<br/>gov ID, SSN, card details]
    B -->|Windows| D[Update My Information button]
    D --> E[AccountGuardSetup.zip -> .vbs]
    E --> F[Nested base64 PowerShell chain]
    F --> G[Download 17MB ScreenConnect .msi]
    F --> H[AES-128-CBC C# -> UAC bypass]

Notable specifics beyond the summary:

• The credential path double-prompts the password (faking an error) and then collects full name, mailing address, government ID, SSN, and payment card details.
• The Windows download is AccountGuardSetup.zip containing AccountGuardSetup.vbs.
• The decoded PowerShell is written to the user's My Documents folder and run after a delay; nesting is PowerShell inside base64 script inside base64 blob.
• The ScreenConnect MSI is fetched (base64-encoded) from the legitimate file-sharing site UploadToURL.com, decodes to ~17MB, and is written to %localappdata%\Microsoft\sc.msi.
• The AES-128-CBC key is stored as a plaintext UTF-8 string in $key; the IV is the first 16 bytes (32 hex chars) of each blob. One decrypted blob ($csharpCodeDecrypted) is compiled and run to perform the ICMLuaUtil UAC bypass (T1548.002).

What to do

Hunt for these observable artifacts:

• Sender domain / address onlinebanking@ealerts[.]bkofamerica[.]com.
• AccountGuardSetup.vbs / AccountGuardSetup.zip execution.
• PowerShell scripts written to a user's My Documents and run after a delay.
• Outbound download from UploadToURL.com.
• The file path %localappdata%\Microsoft\sc.msi and unexpected ScreenConnect installs.

General guidance from the page: never run a .vbs file you didn't create or fully understand.

Caveats

The page text cuts off mid-sentence during the UAC-bypass explanation, so the full C# mechanism and any concluding remediation are not captured here. Domains/addresses are reproduced as the page defanged them; treat as IOCs, not clickable. UploadToURL.com is described as an otherwise-legitimate service abused for hosting.