Hackers Leverage Polyglot Files to Evade Email Filters and Deliver Malware

A new wave of phishing campaigns has been detected, revealing a significant shift in threat actor tactics designed to evade email security measures and compromise targeted organizations.

Attackers are now leveraging masquerading methods, including the use of polyglot files files structured to appear as multiple formats at once to successfully bypass spam filters and deliver advanced malware.

The classic distribution of harmful macros and office documents has largely been replaced by alternative vehicles such as LNK shortcuts, with malicious payloads cleverly concealed within ZIP-compressed polyglot files.

Phishing Tactics

The latest campaigns stand out for exploiting legitimate email addresses from previously compromised entities to send phishing emails.

These messages sport plausible subject lines, written in Russian, like “Транспортная накладная ТТН № 391-44 от 26.06.2025” (Waybill WB No. 391-44 dated June 26, 2025) and “Договор РН83-371” (Contract PH83-371), designed to create a sense of urgency and authenticity.

Each email carries a ZIP attachment meticulously engineered as a polyglot file; within lies a PE32+ dynamic link library (DLL) that not only acts as the primary infection vector but also contains a legitimate-looking decoy document and a further embedded ZIP archive with a malicious LNK file.

Upon an unsuspecting user’s execution of the LNK shortcut, an intricate infection sequence commences.

The LNK script systematically searches for its associated ZIP polyglot either in the current directory, recursively in %USERPROFILE%, or within the TEMP folder.

Upon locating the payload, rundll32.exe is used to execute the DLL, specifically invoking the exported EntryPoint function.

The LNK then proceeds to carve out the decoy content from the polyglot’s byte stream using predefined offsets and lengths, deploying the document into %TEMP% and launching it with a standard command-line execution to minimize suspicion.

Embedded PowerShell scripts dictate this process, further masking the malicious operations from real-time monitoring solutions.

The PhantomRemote Backdoor

The core objective of these campaigns appears to be data collection and sustained remote access. At the heart of the operation lies PhantomRemote, a backdoor PE32+ DLL written in C++.

Immediately after execution, PhantomRemote engages in system reconnaissance by collecting the host’s GUID, computer and domain names, and establishing a dedicated working environment in directories such as %PROGRAMDATA%\YandexCloud or %PROGRAMDATA%\MicrosoftAppStore.

The malware then connects to various command-and-control (C2) endpoints over HTTP, embedding system information into GET requests while masquerading as legitimate software through User-Agent strings like YandexUpdate/1.0 and MicrosoftAppStore/2001.0.

According to the Report, PhantomRemote is capable of executing a range of commands issued from its C2 infrastructure.

Notably, it can run arbitrary shell commands, download additional binaries via specified URLs, and maintain ongoing communication by sending the results of its operations back to the control server using POST requests.

Its design ensures persistence through directory creation and flexible payload management. The backdoor minimizes security alerts by incorporating timed sleep loops between command executions and error states, thus blending in with background processes.

Interestingly, this technical evolution in phishing methodology is paralleled by a broader trend among hacktivist groups.

Once motivated mainly by ideological concerns, these actors are increasingly engaging in traditional cybercrime embracing espionage and financial theft while adopting commercially available attack toolkits and infrastructures.

The persistent success and sophistication of these operations underscore the importance of updated defensive strategies across enterprise environments.

Security teams are urged to monitor not only for known malicious hashes and IP addresses but also behavioral patterns indicative of polyglot leveraging and LNK-based infection vectors.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates