Researchers report Iranian-linked APT groups using legitimate cloud services to hide command-and-control traffic, and separately running spear-phishing campaigns. In the phishing cases, attackers used credible “podcast” or “interview invitation” themes to persuade targets to open a Windows shortcut (LNK) disguised as a PDF, leading to installation of the TAMECAT spying toolkit.
According to DarkAtlas reporting, APT42 ran a spear-phishing campaign in April and May 2026 that targeted individuals associated with the nuclear energy sector. The lure was a podcast or interview invitation, a pretext designed to feel like a normal professional opportunity rather than an attack. Targets included nuclear energy staff, researchers, engineers, and executives.
The email carried an attachment presented as a PDF invitation. In reality, the file was a Windows shortcut (LNK), a format that can execute commands when opened. Clicking the attachment led to installation of the TAMECAT surveillance framework, giving the attacker a foothold for further activity.
The lure worked because it leaned on a routine, low-suspicion scenario. A podcast or interview request from someone claiming to be a host or journalist does not automatically raise alarms, especially for staff who are accustomed to being asked to speak publicly about their work. The pretext gave a plausible reason to open an attachment quickly, and the file's disguise as a PDF reduced the chance that a recipient would question its true format before opening it.
This fits a broader pattern described in the reporting: threat actors abusing legitimate-looking channels, whether that is a believable professional request or, in related campaigns, legitimate cloud services used to mask command-and-control traffic. In both cases, the surface appearance of normalcy is what lowers a target's guard.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
APT42 used podcast and interview invitations as a social-engineering theme, presenting the request as a credible professional engagement before delivering malware.
The attackers sent Windows shortcut (LNK) files disguised as PDF documents, which if opened led to installation of the TAMECAT surveillance framework.
DarkAtlas reported that APT42 targeted individuals associated with the nuclear energy sector between April and May 2026, including researchers, engineers, and executives.
Attackers can hide command-and-control traffic behind legitimate services like calendar events or cloud scripting platforms, making it blend in with normal activity and complicating detection.
You get an email: a podcast wants to interview you about your work. Sounds flattering, right? APT42 is sending these fake podcast and interview invites. The 'PDF' they attach is actually a Windows shortcut, an LNK file that installs their TAMECAT spying toolkit. Here’s the trap: the invite looks professional, the traffic looks like normal cloud use, but the attachment type gives it away. A '.lnk' file pretending to be 'something.pdf' is the red flag. If you get an unsolicited podcast or interview invite with a 'PDF' attached, stop. Don’t open it. Forward it to security and ask them to check the file type.
Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into…
U.S. prosecutors say a Russian national used hundreds of fake accounts on a freelance platform to send Excel files that tricked users into enabling macros, which then downloaded remote-control malware. The campaign targeted tens of thousands of users and led to thousands of infections, enabling…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Bitdefender reports a China-linked espionage campaign (“SilkParasite”) targeting government bodies in Central Asia using spearphishing emails carrying malicious Microsoft Office documents. The malware is designed to stay quiet and blend in, including using Google Drive as a communications channel…
