Even the Unsubscribe Link Installed a Remote-Access Tool

**Executive summary:** A phishing email cloned a legitimate greeting-card template and globally rewrote nearly every link to point to a ScreenConnect remote-support installer requesting guest access; authentication and URL reputation checks passed and the file was signed, so the message bypassed many automated defenses despite delivering unsolicited remote access into a regional health system.