Researchers report real-world attacks in Korea where victims are tricked into opening shortcut (LNK) files or “security software” installers that secretly install the Xctdoor backdoor. The lures use believable filenames (e.g., account statements, lease documents, resumes) and fake installers (e.g., Veraport/SoftCamp) to get users to execute the malware.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from a coworker: “***_Comprehensive Status Report_(Confidential)_26.4.4.LNK”. Looks like a secret report, right? In recent Korean attacks, that exact kind of LNK shortcut quietly installed the Xctdoor backdoor. It pops a decoy document on screen while three hidden scripts pull encrypted malware from sites like hesenorm.info. Same campaign also ships fake Veraport or SoftCamp “security installers” in compressed files. You unzip, see a legit-looking EXE next to a shady DLL, run it, and Xctdoor is in, scheduled tasks and all. Here’s the move: if an email attachment is a .LNK shortcut or a compressed “security installer,” don’t open it, report it to Security immediately so we can check it for Xctdoor.
Researchers observed real phishing emails posing as transaction receipts to trick people into opening a PDF attachment. The PDF claims an “Adobe Flash Player update is required,” leading victims to download and run a script that silently installs ScreenConnect for persistent remote access.
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
Attackers sent personalized fake federal court notices to more than 100,000 companies, impersonating the US District Court for the Southern District of Florida. The emails directed recipients to a counterfeit court website and offered a password-protected case file that ultimately installed…
A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
