A new and sophisticated phishing campaign has emerged, leveraging advanced techniques to distribute AsyncRAT malware. Cybercriminals are now disguising virtual hard disk (VHD) files as PDF documents, a method that potentially bypasses many standard security measures.
These malicious files are hosted on the InterPlanetary File System (IPFS), a decentralized web hosting service. Victims are lured into downloading these files under the guise of invoices or purchase orders. Once downloaded, these VHD files, when mounted as local drives, execute Windows Script Files (WSF) that effectively bypass Windows security features.
This threat underscores the importance of configuring Windows systems to display file extensions, helping users to identify and avoid suspicious files. By enabling this feature, organizations can arm their employees with the capability to detect disguised threats, reducing the risk of falling victim to this innovative and dangerous phishing scheme.

Collections

Cybercriminals are using a new phishing technique that disguises AsyncRAT malware as PDF files by embedding them in virtual hard disk (VHD) files hosted on IPFS. When victims mount these VHD files, Windows Script Files execute and bypass security features. Organizations can mitigate this threat by configuring Windows to display file extensions, helping users identify suspicious files before opening them.

Phishing Campaign Disguises Malware as PDF Files Using Virtual Hard Disks