Fake Social Security Statement emails trick users into installing remote tool

Malwarebytes documents a phishing campaign attributed to the group “Molatori” that sends emails impersonating the US Social Security Administration to trick recipients into downloading a ScreenConnect remote access client disguised as SSA statement attachments. Once installed, attackers remotely control victims' systems to access and exfiltrate sensitive personal and financial information for fraud; Malwarebytes detects the activity as RiskWare.ConnectWise.CST and blocks a list of associated domains.