Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
This campaign impersonates FedEx with a Korean-language email claiming a tax invoice for 217,740 KRW is due soon. The subject line, "[FedEx] A tax invoice has been issued," is designed to look like routine billing correspondence. The email carries a ZIP archive named Fedex_tax_receipt.zip, which contains a PDF that appears blank when opened. That blank appearance is intentional: the file exists only to run code. Hidden commands called /OpenAction and /Launch start a PowerShell command as soon as the file opens, but only after the victim approves the PDF reader's security prompt. Once approved, the PowerShell command loads the Sirius Backdoor directly in memory, which can steal Chromium browser credentials, capture webcam and microphone feeds, proxy traffic through SOCKS5, alter cryptocurrency wallet addresses, and weaken system defenses.
The pretext targets people whose job is to process invoices, accounts payable, accounting, finance, and billing staff, making an unsolicited invoice seem plausible rather than suspicious. The urgency created by a specific amount due soon pushes recipients to act quickly instead of verifying the request. The attack also relies on a layered trick: even after the ZIP and PDF are opened, the victim must still approve a security prompt, meaning the campaign depends on tricking the user one more time at the final step.
Organizations should train accounts payable, accounting, and billing staff to treat unexpected invoices, particularly those delivered as ZIP files, as suspicious until verified through a known FedEx or vendor contact channel. Staff should be told explicitly never to approve a PDF-reader security prompt for a document that should only contain an invoice, and instead to stop and report the message. Because invoices should never need to run commands or launch other applications, any blank or unusual-behaving PDF deserves scrutiny. Combining this awareness training with technical monitoring for unusual process chains, such as PDF readers spawning PowerShell, gives defenders two chances to catch the attack before the Sirius Backdoor can execute.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers send a Korean-language email claiming a FedEx tax invoice of 217,740 KRW is due, with a ZIP attachment containing a blank-looking PDF that triggers a security prompt and, if approved, runs a PowerShell command loading the Sirius Backdoor in memory.
The emails target people who handle bills and payments, including accounts payable, accounting, finance, billing staff, procurement, and executive assistants.
It can steal Chromium browser credentials, capture webcam and microphone feeds, use a SOCKS5 proxy, alter cryptocurrency wallet addresses, and weaken system defenses.
Warning signs include an unexpected tax invoice arriving as a ZIP file, urgency about a payment being due soon, a blank PDF, and a request to approve a security prompt.
A FedEx tax invoice for 217,740 won, due soon? The attachment is Fedex_tax_receipt.zip. Inside, a blank-looking PDF asks you to approve a security prompt. That click launches PowerShell and loads the Sirius Backdoor. Here’s the giveaway: an invoice shouldn’t arrive zipped, look blank, or ask to run anything. Sirius can steal browser passwords and access your webcam and microphone. Don’t approve that prompt. Report the email to your security team.
Researchers reported a real malware campaign where attackers use Spanish-language “voucher claim” messages to trick people into running a Windows Shortcut file. After the user clicks it, the malware pulls commands from an FTP server’s welcome banner and continues downloading additional payloads,…
Researchers described a real malware campaign where victims are tricked into opening a document-themed attachment that ultimately installs a remote access trojan (RAT). The infection chain uses a PDF that leads to a disk image containing a Windows shortcut (LNK) disguised as a Word document, which…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Researchers say a law firm was targeted with a spear‑phishing email that led staff to download an encrypted archive containing a Windows shortcut labeled like legal case files. After the user ran it and approved admin rights, the malware told Microsoft Defender to ignore a folder and a fake…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Attackers are using Microsoft Teams external chat to pose as internal IT support staff, often after overwhelming employees with email subscription messages. They persuade victims to join a voice call, approve remote-control tools, or run commands, with some incidents ending in malware infections…
