Fake FedEx tax invoices spread Sirius Backdoor in fileless Korean phishing campaign
TechNadu · x · 2026-10-27
Trellix researchers uncovered a spear-phishing campaign targeting Korean speakers with malicious PDFs disguised as FedEx tax invoices. The fileless PowerShell infection chain runs entirely in memory, blinds EDR by patching ETW, and deploys a Sirius Backdoor variant via Early Bird APC injection — granting HVNC remote access, SOCKS5 proxying, browser credential theft, and crypto wallet hijacking.
More from Safety
- OpenAI, Google, Anthropic Reportedly Building FINRA-Style AI Self-Regulator by 2027 — emmanuelvivier · 2026-10-27
- IBM Launches Verifiable Identity and Control for Enterprise AI Agents — emmanuelvivier · 2026-10-27
- Mathematicians urge AI labs to stop giving designated mathematicians early access to model results — AndrewCurran_ · 2026-10-27
- AuthorizationBench: LLM agents overstep user authorization in 19.2% of runs — rohanpaul_ai · 2026-10-27
- Anyone can get an abliterated model with safety training stripped out for pennies — EXM7777 · 2026-10-27
- AI Governance Expert Urges Governments to Plan Now: UBI, AI Deployment Taxes, Human-Only Jobs — LuizaJarovsky · 2026-10-27