Fake Ssa Emails Trick Users Into Installing Screenconnect Rat

Cybercriminals are utilizing clone Social Security Administration emails to administer nan ScreenConnect RAT (Remote Access Trojan) and discuss personification computers.

Cybersecurity experts person uncovered ongoing schemes wherever criminals are exploiting nan US Social Security Administration (SSA) to instrumentality group into installing a vulnerable Remote Access Trojan (RAT) called ScreenConnect connected their computers. Once installed, this programme gives nan attackers complete distant control, allowing them to bargain individual accusation and instal much harmful software. 

Researchers astatine Malwarebytes first noticed these clone emails that pass group that their “Social Security Statement is now available” and urged them to download an attachment aliases click a nexus to position it. These emails are designed to look very real, making it difficult for group to show they are fake. 

Image credit: Malwarebytes

The links aliases attachments successful these emails lead to nan download of a record that installs nan ScreenConnect client. To make group deliberation it’s safe, these files are sometimes fixed misleading names, specified arsenic “ReceiptApirl2025Pdfc.exe” aliases “SSAstatment11April.exe.”

ScreenConnect itself is simply a existent instrumentality utilized by companies for IT support, letting technicians thief users remotely. However, successful nan hands of criminals, it becomes very dangerous. Once they person power of a machine done ScreenConnect, they tin look astatine files, tally programs, and bargain delicate information for illustration slope specifications and individual recognition numbers. The criminals down this, sometimes called nan Molatori group, chiefly want to perpetrate financial fraud. 

Security experts astatine Cofense besides reported akin phishing campaigns impersonating nan SSA. The emails often claimed to supply an updated benefits statement, utilizing mismatched links aliases hiding malicious links down buttons.

“While nan nonstop building of nan email changes from sample to sample, nan run consistently delivers an embedded nexus to a ConnectWise RAT installer,” Cofense researchers noted successful their flash alert.

Their findings indicated that these clone emails aimed to instal a ConnectWise RAT, a tainted type of nan legit package ConnectWise Control (formerly ScreenConnect). This run saw an summation successful activity starring up to nan 2024 US statesmanlike elections, peaking astir mid-November 2024.

What makes these attacks tricky to spot is really nan criminals operate. They often nonstop these phishing emails from websites that person been compromised, making nan email addresses look legitimate. They besides often embed nan email contented arsenic an image, which stops email filters from being capable to publication and artifact harmful messages. Furthermore, because ScreenConnect is simply a wide utilized program, regular antivirus package mightiness not automatically emblem it arsenic a threat.

This isn’t nan first clip criminals person misused morganatic distant entree tools. As Hackread.com previously reported, akin strategies person been utilized successful clone LinkedIn emails to dispersed nan ConnectWise RAT.

These clone messages mimicked existent InMail notifications, utilizing older designs to look convincing. Cybercriminals are besides utilizing blase phishing emails that mimic well-known brands to bargain information.

For example, a recent campaign targeted Australian hose Qantas, pinch clone emails designed to look for illustration existent trading messages from nan airline. These emails, discovered by Cofense Intelligence, tricked users into giving distant their in installments paper specifications and individual information.