A Sirius backdoor campaign used Korean-language emails that impersonated FedEx billing notices and demanded payment of a fraudulent tax invoice. The email directed recipients to a ZIP file containing a weaponized PDF, which required the recipient to approve a PDF-reader security prompt before it launched hidden PowerShell commands. The malware then hid inside legitimate Windows processes and contacted attacker-controlled infrastructure.
The campaign started with Korean-language emails impersonating FedEx billing notifications. The message claimed the recipient owed a tax invoice of 217,740 KRW and pushed them toward a ZIP file named Fedex_tax_receipt.zip. Inside the ZIP was a weaponized PDF that looked like a normal invoice document.
Opening the ZIP and PDF alone did not trigger compromise. The attack depended on the victim approving a PDF-reader security confirmation prompt. Once approved, the PDF used /OpenAction and /Launch objects to invoke PowerShell with hidden window, noninteractive, and execution policy bypass arguments, allowing the Sirius backdoor to load without obvious signs of trouble.
The lure combined two pressure points that make social engineering effective: a trusted shipping brand and an urgent payment demand. Recipients expecting routine shipping or billing communication had reason to open the file quickly rather than scrutinize it. The additional step of approving a security prompt added a false sense of legitimacy, since it resembled a normal software permission request rather than an obvious warning sign.
Once active, the malware used hidden PowerShell, in-memory loading, process hollowing, and Early Bird APC injection to reduce its visibility. It could run inside legitimate-looking processes such as msbuild.exe and svchost.exe, making detection harder for both users and monitoring tools.
Treat unexpected invoice attachments as suspicious even when they appear to come from a well-known shipping company, and verify invoices through an established contact or official website rather than the email itself. Employees should be trained not to approve PDF-reader security prompts for unsolicited documents and to report such prompts instead of clicking through them.
Finance, accounts payable, procurement, and executive assistant roles are natural targets for this kind of lure because they routinely process invoices and shipping notices. Security teams can reinforce awareness by highlighting how urgency and brand familiarity are combined to lower scrutiny, and by mapping this behavior to known techniques such as T1566.001 and T1204.002 for detection and training purposes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Korean-language emails impersonated FedEx billing notices and demanded payment on a fraudulent tax invoice, directing recipients to a ZIP file named Fedex_tax_receipt.zip containing a weaponized PDF.
No. Execution depended on the victim approving a PDF-reader security confirmation prompt; opening the attachment alone did not guarantee compromise.
The malware used hidden PowerShell, in-memory loading, process hollowing, and Early Bird APC injection, and could run inside legitimate-looking processes such as msbuild.exe and svchost.exe.
Finance, accounts payable, procurement, executive assistants, and other employees who regularly handle shipping, invoice, or vendor communications.
FedEx tax invoice: 217,740 KRW payment required. Sound familiar? The email pushes Fedex_tax_receipt.zip. Inside is a nearly blank PDF. Then your PDF reader asks for security approval. That's the trap. Approve it, and hidden PowerShell can load the Sirius backdoor inside Windows processes like msbuild.exe or svchost.exe. An invoice doesn't need that permission. If an unexpected invoice PDF asks for security approval, don't approve it. Report the email.
Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000…
Russian-linked group UAC-0099 reportedly used a phishing email with a malicious attachment to enter the network of an unnamed Ukrainian grain logistics company. Researchers believe the group then handed access to Sandworm, which carried out a data-wiping attack two months later, disrupting the…
This article describes a real and growing social-engineering technique called ClickFix, where attackers disguise malicious instructions as a familiar CAPTCHA or verification step. In one documented case, a fake free image-editing tool prompted victims to run code that installed malware designed to…
Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
A real credential-phishing campaign used a project bid invitation and a password-protected PDF to target employees involved in sales and contract work. The PDF led victims through a convincing fake document-sharing site and then to a counterfeit Microsoft sign-in page that sent entered credentials…
The article recounts the real ILOVEYOU worm outbreak, which used a romantic email subject line and a supposed love-letter attachment to trick millions of recipients into infecting their computers. Once opened, the attachment spread the same message to everyone in the victim's address book, showing…
