Warning: Phishing Campaign Impersonates the US Social Security Administration

Researchers at Malwarebytes warn that phishing emails are impersonating the US Social Security Administration (SSA) to trick users into installing the ScreenConnect remote access tool.

ScreenConnect is a legitimate tool used for remote IT management, but it can be abused by hackers to take control of victims’ computers.

“Because ScreenConnect provides full remote control capabilities, an unauthorized user with access can operate your computer as if they were physically present,” Malwarebytes explains. “This includes running scripts, executing commands, transferring files, and even installing malware—all potentially without you realizing.”

The phishing emails, sent by the Molatori cybercriminal gang, state, “Your Social Security Statement is now available. Thank you for choosing to receive your statements electronically. Your document is now ready for download.”

If a user downloads the attached file, a ScreenConnect client controlled by the attackers will be installed on their system.

“After cybercriminals install the client on the target’s computer, they remotely connect to it and immediately begin their malicious activities,” Malwarebytes says. “They access and exfiltrate sensitive information such as banking details, personal identification numbers, and confidential files. This stolen data can then be used to commit identity theft, financial fraud, and other harmful acts.”

Malwarebytes offers the following advice to help users avoid falling for these attacks:

“Verify the source of the email through independent sources
Don’t click on links until you are sure they are non-malicous
Don’t open downloaded files or attachments until you are sure they are safe
Use an up-to-date and active anti-malware solution
If you suspect an email isn’t legitimate, take a name or some text from the message and put it into a search engine to see if any known phishing attacks exist using the same methods”

New-school security awareness training can give your organization an essential layer of defense against social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Malwarebytes has the story.

Live Demo: Identify and Respond to Email Threats Faster with PhishER

With only approximately 1 in 10 user-reported emails being verified as actually malicious, how do you not only handle the phishing attacks and threats—and just as importantly—effectively manage the other 90% of user-reported messages accurately and efficiently? PhishER.

To learn how, get a product demonstration of the new PhishER Security Orchestration, Automation and Response (SOAR) platform. In this live one-on-one demo we will show you how easy it is to identify and respond to email threats faster:

Automate prioritization of email messages by rules you set that categorize messages as Clean, Spam, or Threat

Augment your analysis and prioritization of messages with PhishML, a PhishER machine-learning module

Search, find, and remove email threats with PhishRIP, PhishER’s new email quarantine feature for Microsoft 365 and G Suite

NEW! Automatically flip active phishing attacks into safe simulated phishing campaigns with PhishFlip. You can even replace active phishing emails with safe look-alikes in your user’s inbox.

Easily integrate with KnowBe4's email add-in button, Phish Alert, or forwarding to a mailbox works too!