Loading story…
Hackers have launched a sophisticated phishing campaign that impersonates official notices from the National Police of Ukraine to target organizations running Microsoft Windows. The campaign begins with emails containing malicious Scalable Vector Graphics (SVG) files, which are exploited due to their text-based nature that allows embedding of harmful scripts. When recipients open the SVG attachment, they are presented with a deceptive loading screen, after which the system downloads password-protected ZIP archives such as ergosystem.zip or smtpB.zip. The password is provided in the email to increase the appearance of legitimacy. Inside these archives, a Compiled HTML Help (CHM) file acts as the main trigger, executing a malicious script known as CountLoader. This loader connects to a remote server, exfiltrates basic system information, and then delivers the final malware payloads directly into memory, making detection challenging. The two primary payloads identified are Amatera Stealer, which is designed to steal sensitive data, and PureMiner, a cryptominer that hijacks system resources for illicit cryptocurrency mining. PureMiner is delivered using DLL sideloading techniques from the ZIP archive, while Amatera Stealer is deployed through the same infection chain. Security researchers have highlighted the dual threat posed by this campaign: data theft and resource hijacking. The use of SVG files is particularly concerning because they can contain embedded JavaScript and HTML, and on Windows systems, they are often opened by Microsoft Edge, which may lack adequate security controls if not the user's primary browser. The attackers use formal legal language in the phishing emails to pressure recipients into compliance, increasing the likelihood of infection. The campaign is notable for its fileless approach, as the malware is loaded directly into memory rather than being written to disk. This method complicates detection and remediation efforts for security teams. The infection chain leverages social engineering, technical obfuscation, and multiple stages to maximize its effectiveness. Researchers have also observed creative obfuscation within the SVG files, such as disguising malicious code with food and recipe-related variable names. The campaign demonstrates a high level of technical sophistication and adaptability, exploiting both human and technical vulnerabilities. Organizations are advised to educate users about the risks of opening unexpected attachments, especially SVG files, and to implement robust endpoint protection capable of detecting fileless threats. The campaign underscores the ongoing evolution of phishing tactics and the need for continuous vigilance in email security. Security teams should review their email filtering and endpoint monitoring policies to address this emerging threat vector. The use of password-protected archives and legitimate-seeming legal notices increases the campaign's success rate, making it a significant concern for enterprises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting highlighted related SVG phishing activity involving PureRAT and noted targeting in Ukraine and Vietnam. This expanded the public technical picture of the broader SVG-based phishing threat cluster.
Security researchers disclosed that the SVG-based campaign was delivering Amatera Stealer and PureMiner malware to victims in Ukraine. Multiple reports published over the following days described the same operation and its malware payloads.
A phishing campaign began targeting people in Ukraine with emails impersonating Ukrainian police and carrying malicious SVG attachments. The lures used spoofed law-enforcement notices to trick recipients into opening fileless phishing content.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedarkreading.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcebankinfosecurity.com
Open sourcehackread.com
Open sourcefeeds.fortinet.com
Open sourcegovinfosecurity.com
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign has been identified targeting users in Colombia by impersonating official judicial notifications from the 17th Municipal Civil Court of the Bogotá Circuit. The attackers crafted emails in Spanish, leveraging local institutional details to increase the credibility of the lure. The phishing emails claim to contain a lawsuit notification and prompt recipients to open an attached SVG file. This SVG file is weaponized to initiate a multi-stage infection chain. Upon opening, the SVG file triggers the execution of a malicious HTA (HTML Application) file, which is a common technique for bypassing traditional email security filters. The HTA file then executes a VBS (Visual Basic Script) file, which in turn runs a PowerShell script. This PowerShell script acts as a downloader and loader, ultimately injecting the AsyncRAT remote access trojan into a legitimate Windows process to evade detection. AsyncRAT is a well-known remote access tool that allows attackers to gain persistent control over infected systems, exfiltrate data, and potentially deploy additional payloads. The campaign employs anti-virtual machine techniques to avoid analysis and uses persistence mechanisms to maintain access on compromised hosts. Security researchers have observed that the use of SVG files for initial infection is increasing, as these files can bypass some security controls due to their perceived harmlessness. The campaign demonstrates a high level of technical sophistication, chaining multiple scripting languages and file types to obfuscate the attack and evade endpoint detection. The malicious files have been identified and their MD5 hashes documented for threat intelligence sharing. Detection signatures have been updated by security vendors such as Quick Heal and Seqrite to identify and block the components of this attack. The campaign is notable for its targeted approach, focusing on Colombian users and leveraging local judicial terminology to increase the likelihood of success. The use of AsyncRAT as the final payload provides attackers with extensive capabilities for surveillance, data theft, and further lateral movement within affected organizations. Security teams are advised to educate users about the risks of opening unexpected attachments, especially those purporting to be from legal or government institutions. Organizations should also ensure that email security solutions are updated to detect SVG-based threats and that endpoint protection is capable of identifying the multi-stage infection chain. The incident highlights the evolving tactics of threat actors in using file formats and social engineering tailored to specific regions and institutions.
Jun 29, 2026
Microsoft Threat Intelligence identified a sophisticated phishing campaign targeting U.S.-based organizations, leveraging artificial intelligence to craft highly convincing and evasive attacks. The campaign was detected in late August 2025 and involved the use of compromised small business email accounts to distribute phishing emails. These emails masqueraded as legitimate file-sharing notifications, enticing recipients to open an attachment that appeared to be a PDF but was actually a Scalable Vector Graphics (SVG) file. The attackers exploited the SVG format's flexibility, embedding dynamic and interactive code that could bypass many traditional security tools. Instead of using standard obfuscation techniques, the malicious payload was hidden within the SVG file by encoding it with a sequence of business-related terms, such as 'revenue,' 'operations,' and 'risk,' making the file appear as standard business data. This approach allowed the attackers to disguise the true intent of the file, which was to redirect users to a fake sign-in page designed to harvest credentials. Microsoft noted that the code within the SVG was likely generated or enhanced using large language models (LLMs), a form of AI that can produce complex, human-like text and code, further complicating detection efforts. The phishing emails also employed a self-addressed tactic, where the sender and recipient addresses matched, with actual targets hidden in the BCC field to evade basic detection heuristics. SVG files are particularly attractive to attackers because they are text-based, scriptable, and support features like invisible elements, encoded attributes, and delayed script execution, all of which can be used to sidestep static analysis and security scanning. Microsoft responded by using its own AI-powered security tools to analyze and block the campaign, highlighting the growing trend of AI versus AI in cybersecurity defense and offense. The campaign underscores the increasing adoption of AI by threat actors to automate the creation of convincing phishing lures and obfuscated malware. The use of compromised business email accounts added legitimacy to the phishing attempts, increasing the likelihood of successful credential theft. The incident demonstrates the evolving threat landscape, where attackers continuously adapt their methods to outpace security defenses. Organizations are advised to enhance their email security protocols, educate users about the risks of unexpected file attachments, and deploy advanced detection tools capable of analyzing complex file formats like SVG. The campaign serves as a warning that traditional security measures may be insufficient against AI-driven threats, necessitating a proactive and adaptive security posture. Microsoft’s public disclosure of the attack provides valuable intelligence for defenders to recognize and mitigate similar threats in the future. The incident also highlights the importance of monitoring for unusual email behaviors, such as self-addressed messages and unexpected file types. As AI becomes more accessible to both attackers and defenders, the arms race in cybersecurity is expected to intensify, with increasingly sophisticated attacks targeting organizations of all sizes.
Jun 29, 2026
A Vietnamese cybercriminal group known as Lone None has orchestrated a sophisticated phishing campaign that leverages fake copyright infringement notices to target individuals and organizations globally. The campaign, active since at least November 2024, begins with emails purporting to be from legitimate law firms, demanding the removal of allegedly infringing content from the recipient’s website or social media accounts. These emails are highly convincing, often referencing the recipient’s real online profiles and are translated into at least ten languages, including English, French, German, and Chinese, indicating a broad international targeting strategy. The phishing messages contain links that direct victims to download compressed archives, such as ZIP files, which masquerade as legal evidence documents in formats like PDF or PNG. Upon extraction, these archives contain malware that is executed using DLL side-loading, a technique that abuses trusted, signed applications—such as Microsoft Word or PDF readers—to bypass security controls and run malicious code undetected. The campaign delivers two primary types of information-stealing malware: Pure Logs Stealer and the more recent Lone None Stealer, also known as PXA Stealer. Pure Logs Stealer is designed to harvest a wide array of sensitive data, including passwords, credit card details, session cookies, and cryptocurrency wallet files stored on the victim’s device. The Lone None Stealer, first tracked by Cofense Intelligence in June 2025, is specifically engineered to target cryptocurrency assets. It monitors the victim’s clipboard for copied crypto wallet addresses and surreptitiously replaces them with addresses controlled by the attackers, thereby redirecting any intended cryptocurrency transfers. The campaign’s technical sophistication is further demonstrated by its use of Telegram bot profile pages for initial payload delivery and the deployment of obfuscated, compiled Python scripts to evade detection. Cofense Intelligence has observed that Lone None Stealer has appeared in 29% of all active threat reports involving Pure Logs Stealer since June 2025, highlighting its growing prevalence. The attackers also employ machine translation or AI tools to generate new email templates, allowing them to rapidly adapt and expand their reach. To further evade analysis and detection, the campaign abuses legitimate software such as Haihaisoft, leveraging their signed binaries for malicious purposes. The ongoing evolution of the campaign’s tactics, techniques, and procedures (TTPs) demonstrates a high level of operational agility and technical capability. The campaign’s focus on both personal and financial data, with a particular emphasis on cryptocurrency theft, poses significant risks to individuals and organizations alike. Security researchers recommend heightened vigilance for unsolicited legal notices, especially those containing download links or attachments, and advise organizations to implement robust email filtering and endpoint protection measures. The use of legitimate-looking legal threats and multi-language support increases the likelihood of successful social engineering, making this campaign particularly dangerous for a global audience. The campaign’s reliance on trusted software for malware execution underscores the importance of monitoring for unusual process behaviors and regularly updating security controls to detect DLL side-loading techniques. Organizations are urged to educate employees about the risks of phishing emails and to verify the authenticity of any legal correspondence received via email.
Jun 29, 2026