Attackers Exploit Business Emails for Malware Delivery

Key Takeaways

• Attackers are leveraging common business correspondence, such as delivery complaints or refund requests, to distribute malware.
• The campaign, active between July and August 2026, primarily targeted organizations in East and Southeast Asia, using Japanese, Korean, Vietnamese, English, and Chinese lures.
• Victims are tricked into downloading ZIP archives from fake document or video sharing sites, leading to infections with PureRAT (remote access tool) or PureLogs (information stealer).
• The attackers employ sophisticated evasion techniques, including continuously changing malware loaders, disguising executables as legitimate files, and abusing signed drivers to disable security products.
• Organizations must implement robust email verification protocols, enhance endpoint detection, and educate employees on identifying sophisticated phishing attempts.

Attackers Weaponize Business Emails for Malware Delivery

Cybercriminals are transforming everyday business communications into insidious malware distribution channels. What appears to be a routine email regarding a damaged shipment or a pending refund often conceals a malicious link, guiding unsuspecting employees to a deceptive download page that delivers a harmful ZIP archive.

This sophisticated campaign operated between July and August 2026, primarily targeting entities with communications in Japanese and Korean. The lures exploited common business scenarios like product damage, shipping discrepancies, or exchange requests, creating a sense of urgency. Embedded links in these emails were crafted to appear as legitimate documents or video files, as detailed in a recent analysis by ITOCHU Cyber & Intelligence Inc.

Researchers at ITOCHU Cyber & Intelligence Inc. said in a report that their investigation uncovered landing pages localized in Vietnamese, English, Chinese, Japanese, and Korean. This linguistic diversity suggests a broad operational scope, potentially encompassing a significant portion of East and Southeast Asia.

The consequences of falling victim to these attacks extend far beyond a simple infected attachment. Successful exploitation can lead to the deployment of PureRAT, a potent remote access tool, or PureLogs, a sophisticated information stealer. Both malware types pose significant threats to sensitive business data and establish persistent access for attackers.

The ITOCHU Cyber & Intelligence Inc. report highlighted a key evasion tactic: the campaign’s continuous alteration of the software used to install the malware. This dynamic approach makes traditional file-based blocking ineffective, especially for busy teams handling high volumes of customer correspondence, as new variants can easily bypass existing defenses.

The Deceptive Lure

The phishing emails are meticulously crafted to mimic legitimate business communications. They often state that a package arrived damaged, a recording is available for review, or a refund requires immediate attention. These messages then direct recipients to a fraudulent website, cleverly disguised as a document-sharing or video-viewing platform.

Upon arrival at the fake site, users are prompted to download a ZIP archive, ostensibly because the file is “too large to preview.” The attackers further refine their targeting by dynamically adjusting the landing page’s language based on browser settings and geolocation. Interestingly, mobile users are often presented with a notice preventing the download, a tactic that likely aims to limit exposure to security researchers who might be analyzing the threat on mobile devices.

This method mirrors previous attacks involving weaponized archives, where malicious executables are hidden within seemingly innocuous files, often with double extensions to impersonate common document types like PDFs. In one observed instance, an executable file was disguised as a PDF using a double extension (.pdf.exe).

These archives typically contain an executable paired with a Dynamic Link Library (DLL). One particularly stealthy sample utilized a legitimate, Microsoft-signed program to load a malicious DLL. This DLL was deliberately hidden and padded with extraneous data. Such file obfuscation can circumvent security tools with file-size limitations, allowing the infection process to proceed undetected until it’s too late.

Analysis of email headers revealed further deceptive practices. While the visible sender address appeared to be a legitimate support contact, the ‘Reply-To’ field often pointed to an unrelated Outlook or Hotmail account. Shared identifiers and consistent mailer formats across different messages indicated that these emails originated from a coordinated delivery infrastructure.

Evasive Loaders and Data Theft

Once activated, the malware initiates a multi-stage infection process. Researchers documented the use of bundled Python software, a modified Donut loader, and in-memory code execution, all designed to obscure the final payload and hinder detection.

Malware variants employ various methods to establish persistence, including creating Startup shortcuts, scheduling tasks, or manipulating Registry entries. Some versions actively attempt to degrade Windows’ native scanning and logging capabilities. A particularly concerning tactic involves using a legitimately signed but vulnerable driver to terminate security product processes, effectively blinding endpoint defenses. This echoes known “trusted driver abuse” attacks, where high-privilege system access is leveraged to neutralize security measures. Security teams must remain vigilant for unexpected driver installations, new services, scheduled tasks, and any anomalies in security process execution.

The deployed malware, PureRAT, is designed for extensive data exfiltration. It gathers critical system information, including operating system details, active windows, user names, installed security products, webcam status, and screenshots, all reported back to its command-and-control server. Furthermore, PureRAT can steal sensitive data from web browsers, cryptocurrency wallets, and messaging applications, transforming the initial email compromise into a broader data breach.

Similarly, PureLogs specializes in collecting browser cookies, profiles, Discord data, additional screenshots, and results from file searches. While the core malware payload often remains consistent across samples, the constant rotation of loaders makes detection based solely on static file hashes unreliable. This emphasizes the need for behavioral analysis and endpoint detection and response (EDR) solutions that can identify malicious activity patterns rather than just known signatures.

What You Should Do

• Verify Unexpected Requests: Always independently verify any unexpected requests for refunds, delivery issues, or other urgent business matters through a separate, trusted communication channel (e.g., a known phone number or official website) before clicking any links or downloading attachments.
• Enhance Email Filtering: Implement and regularly update email filtering solutions to block suspicious domains and flag emails containing links to known malicious document-sharing or video-viewing sites.
• Promote Employee Awareness: Conduct regular cybersecurity training for all employees, emphasizing the dangers of phishing, the importance of scrutinizing email senders and links, and recognizing red flags such as requests to download archives for viewing documents.
• Implement Endpoint Detection and Response (EDR): Deploy EDR solutions capable of behavioral analysis to detect anomalous activities, such as unusual process execution, DLL side-loading, persistence mechanism changes (Startup, Scheduled Tasks, Registry), and attempts to disable security products.
• Monitor for Driver Abuse: Actively monitor for unexpected driver installations, new service creations, and any attempts by processes to terminate security software. Investigate any alerts related to these activities immediately.
• Block Known Indicators of Compromise (IoCs): Integrate the provided IoCs (URLs, IP addresses, File Hashes, Domains) into your security infrastructure (firewalls, SIEM, EDR) to proactively block known malicious entities associated with this campaign. Remember to defang IP addresses and domains before configuration.
• Review File Download Policies: Re-evaluate and enforce policies regarding downloading executable files or archives from external sources, particularly those disguised as common business documents.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.