Attackers targeted Colombian organizations with Spanish-language emails posing as urgent court notices. The messages use legal-looking JavaScript or VBScript attachments, sometimes inside ZIP files, to install XWorm and give criminals remote control of the victim’s computer. Employees should independently verify unexpected legal notices and avoid opening script-file attachments.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An urgent Colombian court notice lands in your inbox. Would you open it? Here’s the trick: ACTA_NOTIFICA_TUTELA.js sounds like paperwork. But .js runs code. Opening it starts hidden PowerShell, which downloads XWorm and gives someone remote control of your computer. It may arrive as NOTIFICA_ACTO_PROCESO_TUTELA_PDF.zip. Extract it and the supposed PDF is another .js file. That’s the giveaway: legal-looking name, executable ending. Unexpected court notice? Before opening any attachment, confirm the case through the court’s official portal.
Researchers report a real, ongoing phishing campaign where attackers impersonate well-known companies and send business or payment-themed emails that trick recipients into opening a compressed attachment. Inside is heavily obfuscated script and a file disguised as a TrueType font (.ttf) that…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Researchers reported a targeted espionage operation against Bangladesh’s military and defense organizations using spear‑phishing emails with a booby‑trapped RTF document. When opened, the file pulls malicious content remotely and installs an implant that persists on the device while quietly sending…
A real, ongoing phishing campaign is tricking recipients into opening malicious archives that appear to contain harmless TrueType font files (.ttf) but actually hide a Lua-based loader. Once executed, the loader uses stealthy, mostly in-memory techniques to install remote access trojans and…
Three real malware campaigns targeted people in Brazil and Portugal with fake legal notices, invoice pages, and finance-themed documents. Victims were directed to scripts, installers, or an ISO file that abused trusted VLC, VMware, and Microsoft utilities to load malicious code. The most useful…
Pakistan-linked APT group SideCopy expanded from targeting Indian government entities to targeting Indian academic institutions using spear-phishing. The emails deliver a weaponized ZIP containing a fake “document” shortcut that launches mshta.exe to pull down and run malware, ultimately installing…
