A sophisticated phishing campaign targeting Americans is currently making rounds via fake Social Security Administration (SSA) emails.

These convincingly crafted messages inform recipients that their Social Security Statement is available for download, encouraging them to click on an attached file.

Social security statement (Source – Malwarebytes)

The seemingly legitimate communication bears official SSA branding and formatting that makes it difficult for average users to identify as fraudulent.

When users follow the instructions, they unwittingly download an executable file disguised with names like “ReceiptApirl2025Pdfc.exe” or “SSAstatment11April.exe.”

Despite these innocuous-sounding names, the files actually contain a legitimate remote access tool called ScreenConnect that gives attackers complete control over victims’ systems.

Malwarebytes researchers identified a threat actor group dubbed “Molatori” behind this campaign, named after the domains they utilize to host the malicious ScreenConnect clients.

The group appears primarily motivated by financial fraud, accessing banking details and personal identification information once they gain system access.

The attack leverages several technical advantages that make detection challenging.

The cybercriminals distribute their phishing emails from compromised WordPress sites, ensuring the sender domains appear legitimate.

Additionally, they embed email content as images to prevent effective scanning by email security filters.

Once installed, ScreenConnect-a legitimate remote administration tool-provides attackers with comprehensive system access.

The tool’s legitimate status complicates detection by security solutions, while giving attackers capabilities to run scripts, execute commands, transfer files, and install additional malware without user awareness.

The infection mechanism is particularly insidious as it exploits trust in government institutions.

After installation, the ScreenConnect client establishes a connection to command domains including atmolatori.icu, gomolatori.cyou, and several similar variations.

Malwarebytes detects these suspicious instances as RiskWare.ConnectWise.CST and blocks connections to associated domains.

Security experts recommend verifying email sources through independent channels, avoiding clicking on unexpected links, and maintaining updated anti-malware protection to prevent falling victim to this and similar campaigns.

The post Beware of Fake Social Security Statement That Tricks Users to Install Malware appeared first on Cyber Security News.