Pakistan-linked APT group SideCopy expanded from targeting Indian government entities to targeting Indian academic institutions using spear-phishing. The emails deliver a weaponized ZIP containing a fake “document” shortcut that launches mshta.exe to pull down and run malware, ultimately installing the ReverseRAT remote access trojan for data theft and remote control.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Please review the attached document (ZIP). Open commskll.docx to view.” Looks routine, right? But inside that ZIP, SideCopy hides a fake document: commskll.docx.lnk, with a spoofed PDF icon. Double-click it, and it quietly launches mshta.exe, pulling malware from docsportal.in to install ReverseRAT. Here’s the giveaway: real documents don’t need ZIPs, double extensions like .docx.lnk, or to fire up tools like mshta.exe or weird portals like docsportal.in or dns.educationportals.biz in the background. If you see a ZIP-delivered ‘document’ with a double extension like .docx.lnk, stop. Don’t open it, forward it to IT security and delete the email.
AhnLab reports that many APT attacks targeting organizations in South Korea in July 2026 started with spear‑phishing emails that delivered malicious Windows shortcut (LNK) files disguised as legitimate documents (including resumes). When opened, the LNK runs scripts that install…
Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Researchers described a real malware campaign where victims are tricked into opening a document-themed attachment that ultimately installs a remote access trojan (RAT). The infection chain uses a PDF that leads to a disk image containing a Windows shortcut (LNK) disguised as a Word document, which…
Researchers tracked Kazakhstan-nexus group UAT-6275 (TAG-193) targeting government organizations across Central Asia and the wider CIS using convincing decoy documents tied to diplomacy and energy. The campaigns used malicious files (macro-enabled Word docs, shortcuts, and a WinRAR exploit) to…
Two real, ongoing intrusion campaigns targeted organizations in Latin America, including a Mexican transportation organization and Brazil’s financial sector. In the Brazil campaign, attackers reportedly got in via a resume-themed phishing attachment, then attempted to download and run tunneling…
