Loading story…
Researchers reported a targeted phishing operation against Afghan government employees that impersonates official correspondence from the prime minister’s office and other ministries to trick recipients into opening a weaponized decoy document. The lure is designed to look like legitimate administrative/financial reporting instructions and includes forged signatures; once opened, it deploys FalseCub malware intended to collect and exfiltrate data from infected systems. The activity shows evidence of careful target research, including the collection of Afghan legal and administrative materials (e.g., ministry communications and related documents) that could be reused as future lures.
The operation abused GitHub as temporary payload hosting, with a newly created account used to distribute malware before content was removed, and investigators linked the operator’s online persona (e.g., alias “Afghan Khan” / user afghanking777000) across platforms such as Pinterest and Dailymotion. Telemetry cited by researchers also pointed to Pakistan-linked artifacts (e.g., link creation/upload location) associated with the shortened URL redirecting victims to the GitHub-hosted payload. Reporting described the actor as Nomad Leopard (per SEQRITE Labs’ tracking) but did not provide a definitive attribution to a known state or established APT group.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On January 20, 2026, Seqrite publicly disclosed the campaign, linking the infrastructure and reused online persona to a regionally focused, low-to-moderate sophistication actor it named 'Nomad Leopard.' The company noted OPSEC mistakes such as persona reuse across platforms but did not attribute the activity to a specific country or known threat group.
Researchers found the threat actor had uploaded multiple Afghan government-, legal-, and Taliban-themed documents under the 'Afghan Khan' persona on platforms including Scribd, Pinterest, and Dailymotion. Seqrite assessed these materials were likely prepared for future phishing activity and possible expansion beyond current Afghan government targeting.
In late December 2025, the operators used a newly created GitHub account to host the malicious payloads used in the campaign, blending delivery into legitimate traffic. The infection chain used an ISO attachment containing a malicious LNK that launched a hidden executable disguised as an image file, ultimately delivering the FalseCub information stealer.
Seqrite said the operation was first detected in December 2025 and targeted Afghan ministry and administrative office employees with emails masquerading as official correspondence from Afghanistan’s prime minister’s office. The lures used government-style financial reporting instructions and forged senior-official signatures to entice recipients into opening the files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Pakistan-linked espionage group tracked as **SideCopy** targeted Afghanistan’s Ministry of Finance, provincial finance and revenue offices, and other Pashto-speaking officials with spear-phishing emails that delivered the open-source remote access trojan **XenoRAT**. Seqrite said the campaign, dubbed **Operation XENOFISCAL**, used Pashto-language seminar-themed lures and ZIP archives containing a malicious shortcut file disguised as an internal government document; one decoy was a genuine Ministry of Finance staff directory covering all 34 provinces, suggesting prior reconnaissance or earlier compromise of Afghan government networks. The infection chain abused `mshta.exe`, obfuscated JavaScript, .NET loaders, and reflective loading to establish a largely fileless foothold, then maintained persistence through Windows Registry changes and a scheduled task. Researchers said the attackers used a compromised Afghan education domain and other Afghan government-hosted infrastructure to make traffic appear legitimate, while separating payload delivery from command-and-control servers hosted in Europe, including Frankfurt, to reduce detection. Seqrite attributed the activity to SideCopy with medium-to-high confidence and linked the operation to the group’s broader history of targeting South Asian government entities.
Jun 29, 2026
A targeted spear-phishing campaign hit employees at Pakistan's Punjab Safe Cities Authority (**PSCA**) and the Punjab Police Integrated Command, Control & Communication Centre (**PPIC3**), with attackers impersonating an internal consultant and using **"Safe Jail Project"** lures to make the emails appear legitimate. The messages carried both a malicious Word document and a PDF with misspelled filenames; the Word file relied on a VBA macro and **VBA stomping** to conceal malicious code, while the PDF presented a fake Adobe Reader error that pushed victims toward a bogus update flow. The operation used staged payload delivery to evade detection, including downloads from **BunnyCDN** infrastructure and a malicious ClickOnce application that retrieved payloads such as `code.exe` and `Adobe.exe`. Researchers said the malware established persistence and remote access through **Microsoft Visual Studio Code tunneling** and used **Discord webhooks** to signal compromise and potentially support data theft or exfiltration. Analysis by Joe Sandbox and JoeReverser indicated the toolset was likely custom-built for the campaign and did not match any known malware family in Malpedia.
Jun 29, 2026
Multiple reports highlight **social engineering-driven compromise** rather than exploitation of software vulnerabilities, with attackers relying on trusted-looking communications and infrastructure to bypass defenses. One campaign described by X-Labs uses a “clean” initial business email (often passing `SPF`/`DKIM`/`DMARC`) that contains **no direct malicious link**, instead delivering a **PDF attachment** that leads victims through a multi-stage document chain. The chain leverages reputable cloud services—including **Vercel Blob**—to host intermediary PDFs that redirect to a **Dropbox-impersonation** credential-harvesting page, and then uses a **Telegram bot** as a collection point for stolen credentials, complicating detection and takedown. Separately, researchers reported a targeted operation attributed to **China-linked Mustang Panda** (aka *HoneyMyte*) against government officials and diplomats, using **fake diplomatic briefing documents** themed as U.S./international policy updates to induce execution and install surveillance tooling, including **PlugX** (noted as a DOPLUGS variant). In parallel, U.S. reporting described **HUMINT-style recruitment approaches** tied primarily to China, where adversaries pose as recruiters/consulting firms on email and job platforms to elicit or purchase sensitive information from current/former U.S. government personnel—an espionage pathway that is adjacent to, but distinct from, the phishing/malware activity described in the other reporting.
Jun 29, 2026