Researchers documented a malware campaign that uses a fake business-proposal disk image to trick Windows users into opening a shortcut disguised as a Word document. The shortcut shows a legitimate-looking PDF while silently installing CikaBika Bot, which lets attackers control the device through Discord, collect system details, capture screens, and steal files.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A business proposal arrives: Proposition_Projet.img. That's a disk image, not a document. Inside, a file looks like Word, but it's a Windows shortcut. Open it, and a French PDF appears while hidden PowerShell runs. That's the trick: the PDF is a distraction. CikaBika Bot can then use Discord to take screenshots and steal files. Unexpected proposal in a .img file? Don't open it, report the attachment to security.
Researchers described a real malware campaign where victims are tricked into opening a document-themed attachment that ultimately installs a remote access trojan (RAT). The infection chain uses a PDF that leads to a disk image containing a Windows shortcut (LNK) disguised as a Word document, which…
A Rust-based remote access trojan (CikaBika Bot) was delivered using a document-themed lure that included a malicious Windows shortcut (LNK) and a PDF containing an embedded payload. Once installed, it used Discord as its command-and-control channel to run commands, collect information, and steal…
Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Researchers reported a real malware campaign where attackers use Spanish-language “voucher claim” messages to trick people into running a Windows Shortcut file. After the user clicks it, the malware pulls commands from an FTP server’s welcome banner and continues downloading additional payloads,…
