Social Security Scam Emails Use Fake Tax Documents to Install RATs via Datto RMM
Summary
LifeLock reported emails impersonating the Social Security Administration that use fake document links or attachments and Datto RMM to install a RAT. The article says the malware can enable device control and data theft.
Key points
- LifeLock identified emails impersonating the Social Security Administration and using urgent language to prompt recipients to act.
- The messages claim a document is ready and may use labels such as “Important Disclosures” or “Important Regulatory Information.”
- Fake PDF-like links or attachments reportedly use Datto RMM to install a Remote Access Trojan (RAT).
- The article says a RAT can let attackers control a device, monitor user activity and steal private data.
- Recommended precautions include checking the sender’s email address and avoiding links that require software downloads to view documents.
Article Details
- Event Type
- Phishing campaign impersonating the Social Security Administration and delivering a remote access trojan
- Impact
- LifeLock researchers report that the emails use malicious links or PDF-disguised attachments leveraging Datto RMM to install a remote access trojan. The RAT can give attackers control of victims’ devices, monitor user activity, and steal sensitive data. The article says thousands of people across the United States are being targeted.