A fake SSA email installs a legit ScreenConnect RAT that phones home through ConnectWise's own cloud. https://intel.threadlinqs.com/threat/TL-2026-2594 #ThreatIntel #ScreenConnect #ConnectWise #SSAPhishing