Files Are Not What They Seem: Inside the Disguised Attachment Campaign Targeting Businesses

For most of us, opening an attachment is routine. We see a file name, a familiar-looking icon, and assume the computer will do what the label says. Attackers know that assumption well, and a phishing campaign Fortinet’s FortiGuard Labs documented this year exploits it.

Since late March, a large-scale campaign has been sending emails that impersonate reputable companies. The messages usually arrive as invoices, orders, or documents needing review, and they include a compressed archive. Inside the archive is a file designed to look harmless, including TrueType font files that have no business arriving via email. In reality, the file is a script-based loader that installs additional malware.

The software it delivers is well known in security circles. Agent Tesla steals saved passwords and keystrokes, while Remcos and XWorm give an attacker remote control of the infected computer. Researchers also reported a keylogger called Best Private LOGGER. None of these tools are new. The disguise makes the campaign effective because it targets the one thing most security habits rely on: trusting what a file appears to be.

The chain has four stages. First, the victim receives a convincing email with an archive attached. Second, they open the archive and run the file inside, believing it is a normal document or an ordinary resource. Third, a heavily obfuscated script runs. Obfuscation deliberately scrambles the code so security tools and human analysts cannot easily read it. Finally, the script copies itself into the computer's Public Libraries folder and creates a scheduled task so it runs again after every restart.

That last step explains why the infection can go unnoticed. Nothing dramatic happens on screen, and the user may assume the attachment was simply broken. Meanwhile, the malware is quietly running in the background, collecting credentials and waiting for instructions.

A file extension, the short tag at the end of a name such as .pdf or .docx, is only a label. It tells Windows which program should open the file, but it does not guarantee what is actually inside. Attackers use that gap in several ways: they rename files, hide scripts in archives, and choose file types that look too boring to question. Security tools that decide based on file type alone can miss this, which is why detection increasingly focuses on what a file does rather than what it is called.

The most effective defense is also the simplest. Treat any unexpected compressed folder with suspicion, even if it appears to come from a familiar company, because logos and names are easy to copy. Look for mismatches between the message and the attachment. A font file sent with an invoice makes no sense, and that mismatch is the warning sign.

If you are unsure, do not open the file. Contact the sender by phone using a number you already have, not one from the email, and report the message to the IT Helpdesk. If you opened something and then felt uneasy, say so right away. Quick reporting often allows us to stop a problem before it spreads, and nobody will be criticized for speaking up.

For helpdesk and frontline IT staff, the report usually sounds the same: a user opened an archive from an invoice-style email, and nothing seemed to happen. That silence is itself a clue. On the endpoint, check the Public Libraries folder for scripts or unfamiliar files, review scheduled tasks pointing to that location, and look for script hosts such as wscript.exe or cscript.exe launching from temporary or archive extraction folders. Any one of these findings is enough to treat the machine as compromised.

Isolate the device first using EDR isolation or by disconnecting it from the network, since these tools allow attackers to access the system live. Preserve the original archive and any dropped files before cleaning anything.

Because the malware steals credentials, treat every password used on that machine as exposed and request a password reset and session revocation. Escalate every confirmed execution with the sender address, subject line, and archive details so the message can be removed from other mailboxes.

For systems administrators, network engineers, and operations leaders, each stage of this attack has a control that can stop it. At the email layer, quarantine archives containing script file types, treat password-protected archives as untrusted, and hold files whose content does not match their claimed type. Since attackers have targeted email security appliances with recent exploits, confirm yours are fully patched.

At the endpoint, change the default behavior for script file types through Group Policy so that a double-click opens a text editor instead of running the code. Enable attack surface reduction rules that block script-based downloads and obfuscated scripts, starting in audit mode to catch legitimate dependencies. Alert on scheduled task creation from non-administrative accounts and on files written to the Public Libraries folder. 

On the network, use egress filtering to stop malware from contacting its operators, and segment workstations from gaming, cage, and surveillance systems so one infected desktop cannot reach operations.

On the identity side, assume stolen credentials after any confirmed execution. Revoke tokens along with passwords, and review mailbox rules, forwarding settings, and newly added MFA methods. Finally, have a tested incident response playbook. Rebuilding a confirmed infected machine is the safest default, and any evidence shared with outside parties should follow our tribal data handling requirements.

This campaign succeeds because it relies on ordinary habits rather than advanced hacking. Technology can reduce the risk, but it cannot catch everything. Our frontline staff is the first line of defense against malicious actors seeking to compromise organizations like ours, and a moment of doubt before opening an attachment is one of our strongest protections.