Social Security Email Scam Delivers ScreenConnect Malware Through Fake SSA Notices

A new Social Security email scam is distributing ScreenConnect based malware by impersonating official SSA notices and redirecting victims to a fraudulent Login.gov style download page. The attackers spoof trusted email domains, mimic legitimate SSA communication, and automatically deliver a remote access client that can give threat actors full control of a victim’s computer. This campaign is far more dangerous than typical phishing attempts because it involves a direct malware installation process rather than credential harvesting alone.

The scam email arrives with the subject line “Annual Reminder to Review Your Social Security Statement” and appears to come from the sender name “SSA.GOV”. The message body is structured to look identical to official Social Security Administration communications and references reviewing earnings history, retirement benefit estimates, and personalized statements. Although the text appears authentic, the embedded link redirects victims away from SSA.gov and toward a malicious website that immediately downloads a malware installer.

How the Social Security email scam works

The email contains a link that appears to point to socialsecurity.gov/reviewyourstatement. In reality, it is a redirect that leads to a domain controlled by the attacker. Once clicked, the victim is forwarded through a tracking link and then sent to a fraudulent Login.gov themed webpage designed to appear official. The moment the page loads, it triggers an automatic download of a malicious executable file.

The downloaded file is typically named ScreenConnect.ClientSetup.exe, although variants may use different file names. This file installs a ScreenConnect remote access client configured to connect to an attacker controlled server. As soon as the program is executed, the attacker can establish a remote session on the victim’s device.

What ScreenConnect is and why attackers use it

ScreenConnect, now known as ConnectWise Control, is a legitimate remote support platform used by IT service providers, managed service providers, and technical support teams. The software allows authorized technicians to view and control a computer, transfer files, run scripts, install software, and perform maintenance tasks. Under normal circumstances, ScreenConnect is a trusted and widely used remote administration tool.

Cybercriminals have increasingly adopted ScreenConnect in malware campaigns because it offers several advantages:

• The application is legitimate and digitally signed, which helps it bypass antivirus detection.
• It allows full remote control of the victim’s computer once a connection is established.
• Attackers can deploy it silently by pointing the client installer to a malicious server address.
• No custom malware development is needed because the remote access functionality already exists within ScreenConnect.
• The attacker can persist on the system even after reboots or password changes.

When misused, ScreenConnect effectively becomes a remote access trojan. Once installed, the attacker can monitor activity, steal credentials, access personal files, install additional malware, and even deploy ransomware. The program may appear under Installed Apps as “ScreenConnect Client” or a similar name with a unique identifier. Although the publisher is listed as ConnectWise, LLC, this does not indicate safety. Attackers often use the legitimate signed binary and configure it to communicate with their own control infrastructure.

What happens if the malware is installed

If a victim executes the downloaded ScreenConnect installer, the threat actor gains the ability to interact with the computer in real time. This includes:

• Viewing the desktop and active applications
• Moving the mouse and typing
• Copying or deleting files
• Installing additional malware
• Capturing passwords and session tokens
• Escalating privileges or moving laterally across a network
• Deploying ransomware or extortionware

This type of compromise is severe because the attacker’s access is immediate and does not depend on tricking the user into typing credentials. The danger remains until the remote access client is fully removed and all compromised passwords have been reset.

Indicators of compromise

You may be infected by the Social Security email scam if you notice any of the following:

• A file downloaded automatically after clicking a link claiming to come from SSA.gov.
• An installer named ScreenConnect.ClientSetup.exe or a similarly structured file.
• ScreenConnect Client or an unfamiliar remote access application listed in Installed Apps.
• A newly created folder in Program Files, ProgramData, or AppData relating to ScreenConnect.
• Unusual background processes or persistent services referencing remote access functionality.
• Unexpected mouse movement, windows opening on their own, or other signs of remote interaction.

How to remove ScreenConnect malware

If the malicious ScreenConnect client was installed, immediate removal is required. The following steps can help eliminate the remote access tool and protect your device:

• Open the Windows Settings menu and uninstall any entry labeled ScreenConnect Client or similar.
• Delete any residual folders located in Program Files, Program Files (x86), ProgramData, or AppData that contain ScreenConnect related files.
• Restart your computer to terminate any active remote sessions.
• After rebooting, scan your device using Malwarebytes, which can detect and remove malware and potentially unwanted programs. Malwarebytes is available at Malwarebytes.
• Check your system for unknown startup items or scheduled tasks that may indicate persistence.
• Change all account passwords and enable multi factor authentication where available.

If you believe the attacker accessed sensitive files or credentials, consider additional remediation steps such as notifying affected institutions or performing a full system restore.

How to avoid the Social Security email scam

These scams rely on impersonating trusted institutions. The following precautions can help reduce the risk of falling victim to similar attacks:

• Be cautious of unexpected emails claiming to be from SSA.gov or other government agencies.
• Hover over links before clicking to verify the destination domain.
• Never download or run unexpected files, especially if they appear without warning.
• Access Social Security statements only through the official website at ssa.gov.
• Enable real time protection and regularly scan your device for threats.
• Keep your operating system and software up to date.

The Social Security email scam demonstrates how quickly attackers are evolving their tactics by shifting from phishing and credential theft to direct malware distribution. Understanding how these scams operate and knowing what to look for can prevent serious compromises and help protect your personal information.