A Rust-based remote access trojan (CikaBika Bot) was delivered using a document-themed lure that included a malicious Windows shortcut (LNK) and a PDF containing an embedded payload. Once installed, it used Discord as its command-and-control channel to run commands, collect information, and steal data. This is a realistic, repeatable phishing-style workflow that can be used for employee training simulations around opening unexpected “document” files.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Here’s the document,” with a PDF… and a weird extra file next to it. That extra file is a Windows shortcut, an LNK. Click it, and a Rust-based remote access trojan called CikaBika Bot silently installs, then phones home over Discord. From there, CikaBika Bot can run commands, snoop around your files, and stream data out through Discord and ngrok, all while just looking like a normal document you opened. If you ever see a “document” email with a shortcut file like .lnk or anything that wants you to run it, don’t open it, forward it to the security team and delete it.
Researchers described a real malware campaign where victims are tricked into opening a document-themed attachment that ultimately installs a remote access trojan (RAT). The infection chain uses a PDF that leads to a disk image containing a Windows shortcut (LNK) disguised as a Word document, which…
Researchers documented a malware campaign that uses a fake business-proposal disk image to trick Windows users into opening a shortcut disguised as a Word document. The shortcut shows a legitimate-looking PDF while silently installing CikaBika Bot, which lets attackers control the device through…
AhnLab reports that many APT attacks targeting organizations in South Korea in July 2026 started with spear‑phishing emails that delivered malicious Windows shortcut (LNK) files disguised as legitimate documents (including resumes). When opened, the LNK runs scripts that install…
Researchers reported a real malware campaign where attackers use Spanish-language “voucher claim” messages to trick people into running a Windows Shortcut file. After the user clicks it, the malware pulls commands from an FTP server’s welcome banner and continues downloading additional payloads,…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
