Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into opening a PDF and visiting a malicious website that drops a script and ultimately runs an EXE payload.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Invoice attached, please review and process.” Looks normal, right? The attached PDF says, “Click here to view the full document online.” Behind that click is BraZetsu, a Windows malware toolkit used to turn your computer into "access for sale" on underground markets. The phishing PDF sends you to a fake site that scans your environment, then, if you’re in the right region, drops a VBS script and finally an EXE payload. Here’s the tell: a so-called invoice PDF or SVG that doesn’t actually show the document, but pushes you to a website, which then tries to download a script, like .VBS, to "continue." That’s not how real invoices or Edge updates work. If a PDF or invoice email sends you to a site that wants you to download or run a script or EXE, stop. Don’t open it, report the email and the file to Security immediately.
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers reported an active PhantomEnigma campaign where attackers hijacked 20+ Brazilian government websites and used them as trusted stepping-stones to deliver malware. The lure used official-looking police-themed documents (sometimes with QR codes) and emails that could pass common email…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
