Researchers report real-world attacks in Korea where victims are tricked into opening shortcut (LNK) files or “security software” installers that secretly install the Xctdoor backdoor. The lures use believable filenames (e.g., account statements, lease documents, resumes) and fake installers (e.g., Veraport/SoftCamp) to get users to execute the malware.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from a coworker: “***_Comprehensive Status Report_(Confidential)_26.4.4.LNK”. Looks like a secret report, right? In recent Korean attacks, that exact kind of LNK shortcut quietly installed the Xctdoor backdoor. It pops a decoy document on screen while three hidden scripts pull encrypted malware from sites like hesenorm.info. Same campaign also ships fake Veraport or SoftCamp “security installers” in compressed files. You unzip, see a legit-looking EXE next to a shady DLL, run it, and Xctdoor is in, scheduled tasks and all. Here’s the move: if an email attachment is a .LNK shortcut or a compressed “security installer,” don’t open it, report it to Security immediately so we can check it for Xctdoor.
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
Cisco Talos reports a remote access trojan (msaRAT) linked to the Chaos ransomware group that hides its command-and-control traffic inside legitimate Chrome/Edge browser activity. The malware is delivered as a fake “Windows update” MSI and, once run, launches a browser in a special debug mode to…
Attackers are impersonating Bank of America in mass phishing emails to pressure people into clicking a link “to avoid account restrictions.” Mac users are led to a fake login page that steals credentials and personal/financial data, while Windows users are tricked into installing a ScreenConnect…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Researchers reported a real campaign by the China-based Silver Fox group against a Japanese industrial manufacturer. The attack starts with an invoice-themed phishing message that leads victims to open a ZIP file, triggering a DLL sideloading chain and installing ValleyRAT for persistent remote…
Proofpoint linked multiple real-world email campaigns to “Cruciferra,” a commercial crypter service that helps criminals hide malware from security tools. The campaigns used familiar social-engineering themes, tax documents, U.S. Social Security Administration messages, and even bed-bug complaints,…
