ESET reports that the Russia-aligned group UAC-0099 used spear‑phishing emails to trick victims in Ukraine into clicking a link that downloads a malicious archive. The infection chain runs a script that installs MATCHBOIL, which then downloads a spying backdoor (MATCHWOK) and sets persistence so it keeps coming back.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine opening an email that says, “Please use the link below to download the attached archive.” Looks boring, right? That one click can pull down an archive with a VBScript that secretly installs MATCHBOIL, which then drops a spying backdoor called MATCHWOK, taking screenshots and running PowerShell in the background. Here’s the creepy part: if you double‑click it, some versions just pop up a fake daily planner with a cat photo, window titled “Dairy,” both text boxes labeled “Today,” while MATCHWOK quietly sticks around using scheduled tasks or registry run keys. If you ever get an unexpected email link to download an archive, or a file opens a weird decoy app like that cat planner, stop right there and report it to Security, don’t click again, don’t keep testing it.
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
ESET reports that Russia-aligned group UAC-0099 is using spearphishing emails with malicious links to deliver a downloader called MATCHBOIL. The attack relies on tricking a person into manually running a downloaded VBScript, which then fetches and installs further malware and sets up persistence…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
Researchers reported a real spear‑phishing intrusion against a law firm where attackers sent a message with a link to an encrypted archive. The archive contained a Windows shortcut (LNK) disguised as “Case Documents,” and running it launched a multi‑stage loader (“HollowFrame”) that ultimately…
Huntress reported real-world attacks where criminals used social engineering to get victims to install or run remote support tools, then deployed modified (rogue) ScreenConnect clients. After gaining control, the attackers ran scripts to recon the system, stage additional payloads, and spread the…
Researchers say a law firm was targeted with a spear‑phishing email that led staff to download an encrypted archive containing a Windows shortcut labeled like legal case files. After the user ran it and approved admin rights, the malware told Microsoft Defender to ignore a folder and a fake…
