Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Trapwot Scareware Activity Spikes in April

Summary: Unit 42 tracked an email campaign distributing the Trapwot scareware family, with AutoFocus identifying 380,000 emails carrying over 5,400 unique malware samples in the past 30 days. The campaign targeted insurance (roughly 120,000 emails, all but 1,600 received by a single large insurer), higher education (about 93,000), and healthcare (about 31,000), using .scr attachments that download a second-stage payload written to %TEMP%\winmgr.exe and a final DLL that spawns a fake antivirus scanner and purchase page.

Key Takeaway: One large insurance company absorbed nearly 120,000 of these emails, so a single organization's mail gateway was the effective front line for most of the campaign's volume. The payload is a 2014-era malware family still generating hundreds of thousands of messages, and it collects victim machine details and a GUID before serving the fake scanner.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026