Routine business messages are being weaponized as malware delivery tools, dodging traditional defenses and putting companies at risk. Between July and August 2026, phishing emails disguised as typical support communications—like claims of damaged deliveries or refund needs—have lured recipients into malicious traps. Once users click, they’re directed to fake document-sharing or video-viewing pages that demand downloading a ZIP archive corrupted with malware.
Threat Campaign Spreads Across Languages and Borders
This campaign has struck organizations across East and Southeast Asia, with messages crafted in Korean and Japanese, and fake landing pages also available in Vietnamese, English, Chinese, Japanese, and Korean. The diverse language and regional targeting suggest attackers are casting a wide net. A consistent tactic includes using file names or links that appear mundane—delivery details, inspection records, or video previews—to build urgency and avoid suspicion.
Deep Infection Chains and Malware Variants in Use
Analysis reveals these ZIP files don’t just contain simple attachments—they bundle executables with DLLs, and sometimes use legitimate signed Microsoft programs to sideload malicious DLLs. Extra padding is added to bypass file size limits, hindering detection by both automated tools and defenders overloaded with everyday email traffic.
Once executed, the malware follows a layered path: loaders based on Python, modified Donut loaders, and in-memory executions. Persistence is achieved through Startup folder entries, scheduled tasks, Registry modifications. At least one variant was seen abusing a signed but vulnerable driver to disable security product processes. The malware strains stealing data—PureRAT and PureLogs—can grab screenshots, OS and user details, browser cookies, Discord data, and even crypto wallet info.
Detection Challenges, Indicators, and Defense Strategies
Because the campaign keeps rotating its loaders and modifying executables, detection based only on file signatures or simple heuristics is failing. One sample even used double extensions to make an EXE masquerade as a PDF. Security alerts often come after infection when archival file size limits or missing attachments lower visibility. Attackers are also using fake Reply-To addresses—looking like support channels but ending up routed through Outlook or Hotmail—to further obfuscate origins.
Researchers have published a table of Indicators of Compromise (IoCs), including several malicious domains and IPs, file SHA-256 hashes linked to PureRAT and PureLogs, and examples of URLs that masquerade as document-sharing or video sites. Networks delivering the emails often appear interrelated.
To counter these tactics, companies are advised to adopt layered defenses. That means combining email filtering with behavior monitoring, employee training, and rapid incident reporting. Key practices include verifying refund or damage requests via separate, trusted channels; flagging unusual archive attachments; keeping a lookout for DLL side-loading; and monitoring persistence-related changes like new services or startup entries.
The malware’s ability to change loaders and hide payloads fundamentally challenges signature-based security. While no single tactic is foolproof, coordinating multiple lines of defense can reduce exposure, especially when email traffic looks innocuous but contains hidden threats. Understanding these evolving techniques and instituting proactive policies will be essential for any organization that handles business email at scale.
