China-linked espionage campaigns used compromised websites to show selected visitors a fake Chrome certificate warning and persuade them to install a “Certificate Fix” utility. The same malware was also delivered to Indonesian organizations in phishing emails using a shortcut file disguised as a PDF, showing employees how a trusted-looking warning or document can become an entry point for espionage.
This campaign used two different lures to deliver the same malware family. In the first, attackers compromised legitimate websites belonging to government, shipping, IT, and research organizations, injecting obfuscated JavaScript that selectively served visitors a fake Google Chrome SSL certificate warning. The warning instructed targets to install a "Certificate Fix" utility, packaged as a trojanized MSI installer, which actually deployed SquadC or a SparrowDoor variant.
In a second, related chain, the same malware reached Indonesian organizations through phishing emails carrying a Windows Shortcut (LNK) file disguised as a PDF document. Opening the file abused the legitimate ftp.exe binary to run a batch script that displayed an empty decoy file while quietly launching SquadC through DLL sideloading.
Both lures relied on trust in something employees normally accept without question: a browser security warning and a document attachment. Because the compromised websites were legitimate and frequented by the intended targets, visitors had no obvious reason to doubt a warning appearing on a familiar site. Similarly, a file that looks like a PDF, even when it is actually a shortcut, is easy to open without a second thought, especially when Windows hides file extensions by default.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers injected obfuscated JavaScript into compromised government, shipping, IT, and research websites, then showed selected visitors a fake Google Chrome SSL certificate warning urging them to install a "Certificate Fix" utility, which actually deployed SquadC or a SparrowDoor variant.
Yes. The same malware was distributed via phishing emails to Indonesian organizations using a Windows Shortcut (LNK) file disguised as a PDF document, which triggered a decoy file display while launching SquadC through DLL sideloading.
Targeted sectors included telecommunications, government, military, research institutions, critical infrastructure, shipping, and information technology across Latin America, Asia, and Europe.
Never install a security fix, certificate tool, or browser utility offered by a website; instead report the warning to IT and access the site through a known, trusted route.
A real website can show you a fake Chrome warning. Compromised government and shipping sites told selected visitors: ‘Install a Certificate Fix utility to restore access.’ That download was an MSI installer for SquadC or SparrowDoor malware. Here’s the giveaway: Chrome doesn’t need a website’s repair tool. Another route used a ‘PDF’ email attachment that was really a Windows shortcut, .LNK. If a site offers a certificate fix or an attachment isn’t a real PDF, stop and report it to IT.
Check Point Research linked three China-nexus espionage clusters to the CopperDragon malware ecosystem. In its SilentDelivery campaign, attackers compromised legitimate websites and replaced them with fake Chrome certificate warnings that urged selected visitors to install a malicious “Certificate…
Attackers used fake ChatGPT, Claude, and Cursor AI application listings to trick Windows users into downloading malware. The downloads appeared trustworthy because they were hosted through GitHub and included real, digitally signed OpenAI or Anthropic executables, but malicious files alongside them…
Blind Eagle is using Spanish- and Portuguese-language phishing emails that look like court, prosecutor, and administrative notices to target organizations in Latin America. The emails pressure people who handle legal or institutional requests to open an attachment, which ultimately installs…
Microsoft observed real Q3 2026 phishing campaigns that used familiar workplace requests to steal credentials or deliver malware. One campaign targeted legal organizations with personalized salary-review documents containing QR codes, while another used purchase-order and payroll lures in disguised…
The article describes active campaigns that use familiar business documents, trusted file-sharing services, AI brands, and Microsoft sign-in flows to trick employees into granting account access. The most actionable patterns are phishing emails and document links that lead victims to Microsoft…
North Korean-linked attackers reportedly used a fake job opportunity, multiple interviews, and a malicious coding assignment to compromise a Binance engineer. The scheme built trust over weeks before asking the employee to download an interview file, giving attackers a foothold in the company’s…
