Loading story…
Unit 42 reported that an early August 2022 phishing campaign delivered the IcedID information stealer through a polyglot Microsoft Compiled HTML Help (.chm) file embedded in a ZIP attachment containing an ISO image. The CHM file initially displayed a benign help window, then re-executed itself through Mshta.exe to launch hidden malicious HTA content, which in turn executed a concealed DLL named app.dll identified as a 64-bit IcedID payload.
The researchers said the attack used the CHM file's dual behavior as an evasion technique, allowing the same file to appear harmless on first execution and malicious on the second. Unit 42 extracted IcedID configuration data from the DLL and identified the command-and-control URL abegelkunic[.]com and campaign ID 4157420015, warning defenders not to rely on file type alone because polyglot files can legitimately match multiple formats while hiding malware.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
In early August 2022, Unit 42 observed a phishing campaign delivering IcedID via a ZIP attachment that unpacked to an ISO containing a polyglot CHM file. The CHM first displayed a benign help window, then re-executed itself through Mshta.exe to run hidden HTA code and launch a concealed app.dll identified as a 64-bit IcedID payload.
Unit 42 analyzed the IcedID DLL's runtime decoder and extracted its encoded configuration data. The recovered configuration revealed the command-and-control URL abegelkunic[.]com and campaign ID 4157420015.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders detailed multiple **IcedID** intrusion chains that used phishing, hijacked email threads, contact-form abuse, and compromised mail infrastructure to deliver the malware through deceptive attachments and loaders. Campaigns sent password-protected ZIPs, ISO and LNK chains, macro-enabled Office files, and JavaScript or HTA downloaders, while also abusing legitimate services such as Google Sites and trusted email conversations. Several delivery paths relied on **masquerading** techniques, including DLLs disguised as `.jpg` files, fake GZip wrappers, and steganographic payloads hidden in PNG images, with follow-on execution through tools and binaries such as `mshta.exe`, `rundll32`, `regsvr32.exe`, WScript, and PowerShell. Once executed, IcedID unpacked encrypted configurations and payloads, injected into legitimate processes, established persistence with scheduled tasks, and contacted command-and-control infrastructure including URI paths such as `/news/`. Technical analyses showed the malware using custom encryption, custom PE formats, RC4-decrypted PNG loaders, anti-analysis checks, and browser-hook or secondary payload components, while incident reporting tied infections to rapid post-compromise activity including **Cobalt Strike** deployment, credential theft from LSASS, Active Directory reconnaissance, SMB and RDP lateral movement, and use as an access broker for ransomware or espionage operations, including attacks against Ukrainian government entities.
Aug 15, 2026
IcedID operators continued to adapt email-borne delivery chains by abusing hijacked conversation threads, compromised Microsoft Exchange accounts, and password-protected archives to make phishing messages appear legitimate. Across multiple campaigns, victims received PDFs, Word documents, or links to cloud-hosted payloads on Google Firebase or Google Cloud Storage, which led to ZIP archives containing ISO images, malicious LNK files, DLL loaders, or signed executables. Researchers tied parts of this activity to **TA551/Shathak** and reported targeting of organizations in the energy, healthcare, legal, and pharmaceutical sectors, with unpatched public Exchange servers and **ProxyShell** cited as a likely initial access path in some cases.
Aug 15, 2026
A phishing campaign distributed the **Vidar** infostealer through `.ISO` attachments containing malicious Microsoft Compiled HTML Help (`.CHM`) files and a payload disguised as a Word document. Researchers said the infection chain used several nested stages to obscure execution—moving from ISO to CHM to HTA/JavaScript and finally to an executable—while making the lure appear benign to users. In observed samples, a file such as `pss10r.chm` silently relaunched through `mshta` and executed `app.exe`, which was identified as Vidar. The malware used **Vidar version 50.3** and retrieved command-and-control directions from **Mastodon** profile bios before downloading configuration data from C2 servers. Once active, it collected system information, browser and application passwords, and other sensitive data including payment details and cryptocurrency wallets, then exfiltrated the information in a ZIP archive. Researchers also reported that Vidar could download additional malware and remove created files afterward to reduce forensic evidence, underscoring the campaign's focus on stealth and credential theft.
Aug 14, 2026