Social Security scam uses RAT to target thousands

According to HackRead, a new scam is targeting thousands of people across the United States by impersonating the Social Security Administration. This campaign, identified by the security firm LifeLock, arrives during the busy tax season, preying on users with urgent-sounding notifications.

The scam involves emails that appear to be official government notifications, using urgent language like "Important Disclosures." Although the sender may claim to be the Social Security Administration, the emails do not originate from a legitimate .gov domain. These messages typically contain a link or a file disguised as a PDF statement, such as "Social_security_statements_2025.pdf." However, the file utilizes Datto RMM, a tool normally used for IT support, which has been weaponized.

Clicking the link can install a Remote Access Trojan (RAT), allowing attackers to gain full control of a user's device, monitor activity, and steal private data. A key red flag is the urgency to click a "VIEW DOCUMENT" button, often stating the document is only available for a short time. Users are advised to scrutinize sender email addresses and be wary of links requesting software downloads to view simple statements. 

Source: HackRead