Pakistan-linked APT group SideCopy expanded from targeting Indian government entities to targeting Indian academic institutions using spear-phishing. The emails deliver a weaponized ZIP containing a fake “document” shortcut that launches mshta.exe to pull down and run malware, ultimately installing the ReverseRAT remote access trojan for data theft and remote control.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Please review the attached document (ZIP). Open commskll.docx to view.” Looks routine, right? But inside that ZIP, SideCopy hides a fake document: commskll.docx.lnk, with a spoofed PDF icon. Double-click it, and it quietly launches mshta.exe, pulling malware from docsportal.in to install ReverseRAT. Here’s the giveaway: real documents don’t need ZIPs, double extensions like .docx.lnk, or to fire up tools like mshta.exe or weird portals like docsportal.in or dns.educationportals.biz in the background. If you see a ZIP-delivered ‘document’ with a double extension like .docx.lnk, stop. Don’t open it, forward it to IT security and delete the email.
AhnLab reports that many APT attacks targeting organizations in South Korea in July 2026 started with spear‑phishing emails that delivered malicious Windows shortcut (LNK) files disguised as legitimate documents (including resumes). When opened, the LNK runs scripts that install…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Two real, ongoing intrusion campaigns targeted organizations in Latin America, including a Mexican transportation organization and Brazil’s financial sector. In the Brazil campaign, attackers reportedly got in via a resume-themed phishing attachment, then attempted to download and run tunneling…
A real, ongoing phishing campaign is tricking recipients into opening malicious archives that appear to contain harmless TrueType font files (.ttf) but actually hide a Lua-based loader. Once executed, the loader uses stealthy, mostly in-memory techniques to install remote access trojans and…
Researchers reported a real malware campaign where attackers use Spanish-language “voucher claim” messages to trick people into running a Windows Shortcut file. After the user clicks it, the malware pulls commands from an FTP server’s welcome banner and continues downloading additional payloads,…
Researchers report multiple real-world email phishing campaigns that used tax and government-benefit themes to trick people into downloading malware. The campaigns used a “crypter” service called Cruciferra to hide malicious files and help malware run while avoiding detection. Targets included…
