Scammers Exploit ScreenConnect To Defraud SSA Beneficiaries

Cyble Research & Intelligence Labs (CRIL) identified a Zoom-themed phishing campaign that lures victims into installing a digitally signed ScreenConnect remote-access client (Private-Meeting.ClientSetup.exe). The installer drops an MSI and launches a ScreenConnect client that connects to poyttwq.zapto.org (79.110.49.157), an IP also hosting railindiaticket.in used in Social Security Administration (SSA) support scams; the report provides malware analysis, MITRE ATT&CK mappings, and IOCs.