It starts with an email that looks official but is riddled with red flags, like the fake domain The X-labs team’s report<\/a> noted that the script\u2019s first job is to check for administrator powers using a technique called PowerShell auto-elevation. Once it has control, it kills Windows SmartScreen<\/a> (the system that usually blocks suspicious apps from running) by modifying the computer’s registry. It also strips away the Mark-of-the-Web, a hidden digital tag Windows uses to identify files from the internet.<\/p>\n Further investigation revealed the script even uses Alternate Data Streams (ADS) to hide its tracks. Without these alerts, the hackers can perform a silent installation of an MSI file without a single warning appearing on the screen.<\/p>\n Once the guards are down, the script performs a silent installation of ConnectWise ScreenConnect<\/a>. In a normal office, this is a legitimate tool for IT support. However, here, hackers are weaponising it as a Remote Access Trojan (RAT<\/a>) to maintain a permanent “backdoor” into the network. Researchers noted that the software is hardcoded via a System.config file to call back to a specific server:<\/p>\n The attack uses a specific version of the software, It is worth noting that the hackers aren’t just looking for random files; they are specifically targeting high-value data sectors like government, healthcare, and logistics. The script even forces a restart of the Windows Explorer<\/a> process to ensure these security changes take effect immediately.<\/p>\nSSA.COM<\/code> and the misspelling of Statement as “eStatemet.” If a user falls for the bait and opens the attached .cmd script, the computer quietly begins to sabotage its own defences.<\/p>\n![\"Hackers](\"https:\/\/hackread.com\/wp-content\/uploads\/2026\/02\/Hackers-Abuse-ScreenConnect-to-Hijack-PCs-via-Fake-Social-Security-Emails.png\")
<\/a>A Tool for Good, Used for Evil<\/strong><\/h3>\n
\n
25.2.4.9229<\/code>, which carries a revoked (cancelled) security certificate. As we know it, using a signed but cancelled certificate helps the malware look legitimate to some security tools. <\/p>\n