Loading story…
Two separate phishing campaigns were reported using document attachments—rather than obvious links in email bodies—to evade email security controls and steal credentials. One campaign targeting macOS users impersonates audit/compliance and token-vesting workflows, using follow-up “deadline” emails with attachments that appear to be Word/PDF files but are actually AppleScript payloads hidden via double extensions (e.g., Confirmation_Token_Vesting.docx.scpt). The AppleScript stage reportedly displays fake system UI (e.g., software update progress) as a distraction while executing a multi-stage, fileless infection chain intended to collect system information, steal credentials, and establish persistent remote access.
A second campaign uses procurement-themed emails with PDF attachments that embed links via AcroForm objects, helping the messages bypass link-scanning defenses. Forcepoint reported the PDFs redirect victims through a staging chain hosted on trusted infrastructure (public[.]blob[.]vercel-storage[.]com on Vercel Blob) to another PDF and then to a fake Dropbox login page on tovz[.]life. The phishing page uses JavaScript to exfiltrate submitted credentials and victim metadata (including IP and geolocation via api64[.]ipify[.]org and ipapi[.]co) to a Telegram bot using a hardcoded bot token and chat ID, then shows an “Invalid email or password” error after a short delay to encourage repeated entry.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Chainbase Lab detected and SlowMist analyzed a phishing campaign targeting macOS users with fake compliance or audit emails carrying AppleScript attachments disguised as Word or PDF files through double extensions. The malware displays fake system prompts to capture administrator passwords, downloads additional payloads, establishes persistent Node.js-based remote access, and attempts to bypass macOS privacy protections by modifying the TCC database.
Forcepoint reported a phishing campaign using procurement-themed emails with PDF attachments that embed links via AcroForm objects and redirect victims through trusted cloud infrastructure to a fake Dropbox login page. The final site impersonates Dropbox, collects credentials and victim metadata, and exfiltrates them to a Telegram bot while prompting repeated entry with an invalid-login message.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple phishing campaigns used **Adobe-themed document lures** and trusted cloud platforms to gain remote access on victim systems. Cloudflare and CyberArmor reported broad activity abusing **Vercel-hosted** pages that impersonated PDF viewers, invoices, shipping notices, legal alerts, and account warnings, then delivered executables or selectively served payloads after fingerprinting visitors through **Telegram-based filtering**. Rather than relying solely on custom malware, the operators frequently installed legitimate remote management software such as **GoTo Resolve/LogMeIn**, turning signed admin tools into living-off-the-land backdoors while hiding behind trusted domains including `vercel.app` and similar hosting services. A separate but related spear-phishing operation targeted Pakistan's **Punjab Safe Cities Authority (PSCA)** and **PPIC3** with a fake "Safe Jail Project" email carrying a VBA-stomped Word file and a PDF lure. Joe Sandbox found the Word document fetched `code.exe` from **BunnyCDN** infrastructure, invoked Microsoft's **VS Code tunnel** service for covert persistence, and sent compromise notifications to an attacker-controlled **Discord webhook**, while the PDF pushed victims toward an unsigned **ClickOnce** manifest masquerading as an Adobe update. The reporting shows a consistent pattern of attackers blending malicious delivery with legitimate services, signed remote-access tools, and staged payloads to evade detection and maintain control of compromised hosts.
Jun 29, 2026
Threat actors are increasingly abusing *trusted platforms* and familiar workflows to steal credentials and session data, with infostealer operations expanding beyond Windows into **macOS**. Reported campaigns use malvertising, search-engine poisoning, fake apps, and DMG-packaged installers to deliver cross-platform **Python-based stealers** and macOS-focused families (including **AMOS**, DigitStealer, and MacSync) that target browser passwords, Keychain data, crypto wallets, and developer/cloud secrets; this credential theft can enable follow-on compromise such as source-code access abuse, supply-chain intrusion, and ransomware. Separately reported phishing activity shows similar “trust abuse” patterns: a **fake Dropbox** credential-harvesting chain uses benign-looking PDFs and legitimate cloud hosting (e.g., Vercel Blob storage) to evade scanners and email controls, then exfiltrates captured credentials via **Telegram**. Another technique, **ConsentFix/AuthCodeFix**, abuses the OAuth 2.0 authorization-code flow by coercing victims into copying a `localhost` redirect URL containing an authorization code (often for implicitly trusted first-party apps like **Azure CLI**), allowing attackers to exchange it for tokens and effectively bypass **MFA** and Conditional Access protections.
Jul 12, 2026
Threat actors have been observed using spearphishing lures and *non-traditional* attachment types—particularly Windows screensaver (`.scr`) executables—to trick users into running code that silently installs legitimate **remote monitoring and management (RMM)** agents (e.g., **SimpleHelp**). ReliaQuest research described business-themed filenames (e.g., `InvoiceDetails.scr`, `ProjectSummary.scr`) delivered via links hosted on legitimate cloud services (e.g., GoFile), with the `.scr` format helping bypass controls that don’t treat screensavers as executables. Once installed, the RMM tooling provides interactive remote access that can enable data theft, lateral movement, and follow-on payload deployment, including ransomware, while blending into normal IT administration traffic. Separately, researchers also reported a spam operation using **fake PDF attachments** that display an error message and redirect victims to a lookalike *Adobe Acrobat* download flow, but instead installs trusted, digitally signed RMM software to establish persistent access. A different phishing campaign used a multi-stage **PDF chain** hosted on reputable infrastructure (e.g., **Vercel Blob**) to redirect victims to a credential-harvesting page and exfiltrate stolen data via a **Telegram bot**, emphasizing how attackers are increasingly abusing high-reputation cloud platforms and document-based lures to evade email and web filtering (including scenarios where the initial email contains no malicious link and can pass SPF/DKIM/DMARC checks).
Jun 29, 2026