Loading story…
A targeted spear-phishing campaign hit employees at Pakistan's Punjab Safe Cities Authority (PSCA) and the Punjab Police Integrated Command, Control & Communication Centre (PPIC3), with attackers impersonating an internal consultant and using "Safe Jail Project" lures to make the emails appear legitimate. The messages carried both a malicious Word document and a PDF with misspelled filenames; the Word file relied on a VBA macro and VBA stomping to conceal malicious code, while the PDF presented a fake Adobe Reader error that pushed victims toward a bogus update flow.
The operation used staged payload delivery to evade detection, including downloads from BunnyCDN infrastructure and a malicious ClickOnce application that retrieved payloads such as code.exe and Adobe.exe. Researchers said the malware established persistence and remote access through Microsoft Visual Studio Code tunneling and used Discord webhooks to signal compromise and potentially support data theft or exfiltration. Analysis by Joe Sandbox and JoeReverser indicated the toolset was likely custom-built for the campaign and did not match any known malware family in Malpedia.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Analysis by JoeReverser and Joe Sandbox found no match to a known malware family in Malpedia, indicating the malware used in the Pakistan-targeting campaign was likely developed specifically for this operation.
Once executed, the malware established persistent remote access using Microsoft Visual Studio Code tunneling services for command-and-control and sent compromise notifications through Discord webhooks, supporting ongoing access and possible data theft or exfiltration.
The Word attachment used malicious VBA macros and VBA stomping to conceal code that downloaded a payload such as 'code.exe' after users enabled content, while the PDF showed a fake Adobe Reader error to lure victims into downloading a malicious ClickOnce application that fetched another payload. The campaign relied on staged delivery and infrastructure including BunnyCDN to evade detection.
Attackers launched a targeted phishing operation against staff at the Punjab Safe Cities Authority and the Punjab Police Integrated Command, Control & Communication Centre, impersonating an internal consultant and using a 'Safe Jail Project' theme to increase credibility. The emails carried both a malicious Word document and a PDF attachment to deliver malware through separate infection paths.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple phishing campaigns used **Adobe-themed document lures** and trusted cloud platforms to gain remote access on victim systems. Cloudflare and CyberArmor reported broad activity abusing **Vercel-hosted** pages that impersonated PDF viewers, invoices, shipping notices, legal alerts, and account warnings, then delivered executables or selectively served payloads after fingerprinting visitors through **Telegram-based filtering**. Rather than relying solely on custom malware, the operators frequently installed legitimate remote management software such as **GoTo Resolve/LogMeIn**, turning signed admin tools into living-off-the-land backdoors while hiding behind trusted domains including `vercel.app` and similar hosting services. A separate but related spear-phishing operation targeted Pakistan's **Punjab Safe Cities Authority (PSCA)** and **PPIC3** with a fake "Safe Jail Project" email carrying a VBA-stomped Word file and a PDF lure. Joe Sandbox found the Word document fetched `code.exe` from **BunnyCDN** infrastructure, invoked Microsoft's **VS Code tunnel** service for covert persistence, and sent compromise notifications to an attacker-controlled **Discord webhook**, while the PDF pushed victims toward an unsigned **ClickOnce** manifest masquerading as an Adobe update. The reporting shows a consistent pattern of attackers blending malicious delivery with legitimate services, signed remote-access tools, and staged payloads to evade detection and maintain control of compromised hosts.
Jun 29, 2026
An India-linked espionage campaign exploited **`CVE-2026-21509`**, a Microsoft Office security feature bypass in OLE object handling, to target Pakistani government entities, with Sindh Integrated Emergency & Health Services (**SIEHS**) identified as a primary victim. Breakglass Intelligence said the attackers used weaponized **RTF**, **OLE**, and **DOCX** files themed around ambulance surveillance procurement to deliver payloads with little or no user interaction beyond opening or previewing the document. The malicious files embedded **`Shell.Explorer.1`** or **WebBrowser ActiveX** objects and abused an OLE `ObjectPool` stream containing a crafted Shell Link to retrieve **LNK** or **ClickOnce** payloads over **WebDAV** or **HTTPS**, bypassing Office OLE mitigations and avoiding macros.
Jun 29, 2026
Researchers reported a targeted phishing operation against **Afghan government employees** that impersonates official correspondence from the prime minister’s office and other ministries to trick recipients into opening a weaponized decoy document. The lure is designed to look like legitimate administrative/financial reporting instructions and includes forged signatures; once opened, it deploys **FalseCub** malware intended to collect and exfiltrate data from infected systems. The activity shows evidence of careful target research, including the collection of Afghan legal and administrative materials (e.g., ministry communications and related documents) that could be reused as future lures. The operation abused **GitHub** as temporary payload hosting, with a newly created account used to distribute malware before content was removed, and investigators linked the operator’s online persona (e.g., alias **“Afghan Khan”** / user `afghanking777000`) across platforms such as Pinterest and Dailymotion. Telemetry cited by researchers also pointed to Pakistan-linked artifacts (e.g., link creation/upload location) associated with the shortened URL redirecting victims to the GitHub-hosted payload. Reporting described the actor as **Nomad Leopard** (per SEQRITE Labs’ tracking) but did not provide a definitive attribution to a known state or established APT group.
Jun 29, 2026