macOS Malware Hides in Nested Folders to Evade Detection

Key Takeaways

• A new malware campaign, dubbed “Operation Dragon Whistle” by Seqrite, is targeting academic institutions, specifically Changzhou University in China.
• Attackers are employing a sophisticated technique of embedding Windows malware within deeply nested folders that mimic macOS system paths, allowing payloads to bypass traditional security detection.
• The infection chain leverages spear phishing emails with urgent, university-themed lures, ultimately deploying an in-memory Cobalt Strike beacon.
• The threat actor, tracked as UNG0002, exhibits advanced evasion tactics, including DLL side-loading, anti-debugging checks, and command and control infrastructure hosted within Chinese cloud providers.

Recent cybersecurity research has uncovered a sophisticated malware campaign utilizing deeply nested folders, designed to resemble macOS system directories, to conceal malicious payloads and bypass detection by security scanners. This innovative evasion technique, detailed in a comprehensive report by security analysts at Seqrite, poses a significant challenge for current threat detection systems.

The method involves embedding malware several layers deep within archive files, making it difficult for automated scanning tools and even manual inspection to identify the true nature of the contents. The attack begins with a seemingly innocuous compressed file and culminates in the in-memory execution of advanced malware.

Targeting Chinese Academia with Spear Phishing

In a notable instance of this campaign, threat actors specifically targeted students and staff at Changzhou University in China. The attackers crafted highly convincing spear phishing emails, masquerading as official university communications regarding mandatory fitness assessments. These messages were designed to create a sense of urgency and legitimacy, leveraging familiar institutional contexts to encourage recipients to open malicious attachments.

The emails contained a zip archive with a Chinese filename that directly referenced national student physical fitness and health standards. Upon opening the archive, victims were presented with a decoy document that closely mirrored legitimate university paperwork, while the underlying malware silently initiated its infection process.

Seqrite Labs, which has been actively monitoring global spear phishing campaigns, identified this operation as part of a broader trend targeting educational institutions. Their analysis indicates that the attackers possess a deep understanding of university administrative processes and cultural nuances, particularly concerning compulsory testing and graduation requirements. This insight allows them to craft highly effective social engineering lures.

According to the Seqrite report, shared with Cyber Security News (CSN), this campaign, termed “Operation Dragon Whistle,” signifies an expansion of the threat actor’s focus into mainland China’s university sector. Researchers have linked this activity to a group identified as UNG0002, noting similarities with a previous campaign known as Operation Cobalt Whisper, which also employed malicious LNK files and obfuscated VBScript. The name “Dragon Whistle” reflects both the geographical and cultural targeting, as well as the stealthy persistence of the deployed malware.

Nested macOS-like Folders Hide Payloads

The core of this campaign’s deception lies within the malicious zip file itself. It contains four layers of nested folders, meticulously structured to mimic macOS metadata directories. This intricate arrangement is designed to bury the actual payload files deep enough to evade scrutiny from many antivirus engines and archive viewers, while also deterring users from manually traversing the complex directory tree.

The initial layer presented to the user is a double-extension LNK file, disguised as a PDF document. It features a PDF icon and a filename that strongly suggests it is the official fitness testing notice. When a user clicks this LNK file, it exploits the legitimate Windows Explorer process to execute a hidden VBScript payload, rather than directly launching a script interpreter that might raise security flags. This “living off the land” technique allows the malware to blend into normal system operations as it prepares for subsequent attack stages.

The VBScript file, named “chromedo.vbs,” is responsible for coordinating both the user deception and the malware execution. It constructs paths to a decoy PDF and a separate executable, “Bandizip.exe.” The script then opens the convincing decoy document, keeping the victim engaged with the fake content, while the malicious executable runs silently in the background. A brief delay is incorporated between these actions to ensure a seamless decoy presentation, minimizing any visual cues that might trigger suspicion.

Once “Bandizip.exe” is launched, the infection progresses to a DLL side-loading phase. The attackers strategically place a malicious DLL, “ark_x86.dll,” in the same hidden directory as the legitimate Bandizip executable. This exploits Windows’ standard DLL search order, causing the system to load the attacker-controlled library instead of a trusted system file. Within this malicious DLL, the exported function “CreateArk” initiates a series of anti-debugging checks and decryption routines. These steps ultimately unpack and execute an in-memory Cobalt Strike beacon, ensuring the final payload operates without leaving a persistent executable file on disk.

Wider Campaign, Infrastructure, and Defenses

Seqrite’s investigation revealed that this attack is not an isolated incident but part of a larger series of operations employing similar LNK files, nested folder structures, and Bandizip side-loading to deliver Cobalt Strike payloads. By analyzing machine identifiers in various LNK files and examining beacon traffic, researchers uncovered interconnected infrastructure and consistent staging patterns across multiple campaigns. The attackers continuously refine their social engineering and technical approaches, adapting them for different target demographics.

The command and control (C2) server for the Cobalt Strike beacons connects to an autonomous system (AS45102) registered to Alibaba’s advertising network in Hangzhou. This infrastructure has remained active for an extended period. Domain registration and DNS records indicate the use of Chinese domestic providers such as HiChina and Feishu, suggesting a deliberate strategy to anchor operations within regional cloud ecosystems. This tactic complicates defensive efforts, as simple IP or ASN blocking risks disrupting legitimate services hosted on the same platforms.

The malware incorporates various anti-analysis techniques to hinder defenders. These include checks for debugging tools, network analyzers like Wireshark, process monitoring utilities such as Procmon, and other reverse engineering programs. If these tools are detected, the malware diverts to anti-analysis routines and terminates its execution, preventing researchers from observing its full behavior in controlled environments. Additionally, the beacon interacts with Windows security interfaces and event tracing mechanisms to reduce runtime scanning and logging visibility, sacrificing some stability for enhanced stealth.

What You Should Do

• Exercise Extreme Caution with Email Attachments: Treat all unexpected zip attachments with skepticism, even if they appear to originate from trusted institutions, especially those related to fitness tests, policy updates, or exam notices.
• Enhance Email Filtering: Implement stricter email gateway rules to specifically flag or quarantine archives containing LNK files or those with multiple layers of nested folders.
• Increase Archive Inspection Depth: Configure security solutions to perform deeper inspection of compressed files and their contents, particularly those with unusual directory structures.
• Monitor for Anomalous Process Behavior: Deploy endpoint detection and response (EDR) solutions to monitor for unusual execution patterns, such as legitimate utilities (e.g., Bandizip) loading uncommon DLLs.
• Implement In-Memory Threat Detection: Focus on endpoint monitoring capabilities that can detect in-memory payloads, DLL side-loading attempts, and known indicators associated with Cobalt Strike beacons.
• Educate Users: Conduct regular cybersecurity awareness training to inform staff and students about the dangers of spear phishing, social engineering tactics, and the importance of verifying unexpected communications.
• Review IoCs: Integrate the provided Indicators of Compromise (IoCs) into your security tools for proactive detection and blocking.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.