Cybercriminals use Authenticode manipulation in ScreenConnect to distribute malware, bypassing security measures and compromising systems.