Executive Summary
A sophisticated phishing campaign has been identified targeting data-protection analysts within regional nonprofit health systems. The attack leverages legitimate consumer e-card templates, hotlinking original vendor artwork to bypass visual inspection. The campaign is notable for rewriting every single anchor in the email body—including footer links like 'Unsubscribe' and 'Privacy Policy'—to point toward a malicious payload, leaving no safe exit for the recipient.
Technically, the campaign utilizes free consumer webmail accounts (e.g., Gmail) to ensure perfect email authentication (SPF, DKIM, DMARC pass), effectively bypassing many automated security gateways. The payload is a signed, commercial ScreenConnect remote-support installer (MSI) configured to request guest access. Because the payload is a legitimate tool hosted on a reputable domain (screenconnect[.]com), traditional URL reputation and file-scanning engines frequently return a 'clean' verdict.
The business impact is high, particularly for the healthcare sector. Successful execution provides the attacker with an interactive remote session on a managed endpoint, mimicking legitimate help desk activity. This grants the adversary a persistent foothold to move laterally into clinical systems or sensitive data repositories.