Threat actors use copyright infringement phishing lure to deploy infostealers
Summary: Cisco Talos observed an unknown threat actor running a phishing campaign since at least July 2024 that targets Facebook account holders in Taiwan who use the accounts for business or advertising, using traditional Chinese decoy emails and fake PDF files that impersonate a company's legal department alleging copyright infringement and demanding removal of content within 24 hours. Clicking the download link routes through Google Appspot.com domains, a short URL and Dropbox to deliver a password-protected RAR file that runs a fake PDF executable and installs the LummaC2 or Rhadamanthys information stealer, which collects credentials and data and sends them to command-and-control servers.
Why it matters: The lure works because it looks like a legal takedown notice with a 24-hour deadline, and the payload hides inside a legitimate binary while the Rhadamanthys loader inflates itself past 700 MB and registers under the key name "sausageLoop" to survive reboots - defenses tuned to file size and signature checks are exactly what this campaign is built to slip past.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026