Ransomware can be installed via ghost accounts