Attackers Are Turning Everyday Business Emails Into Malware Delivery Machines

Attackers are exploiting routine business complaints by disguising them as malware traps.

Indicators of compromise (IoCs) include: - URL: hxxps://sharedocumentsystem[. ]com/Full_Unboxing_Process_Inspection_Record_333_2026.docx/views/xlqpmzncvaret, hxxps://shareddocumentdrivehub[. ]com/Full_Unboxing_Process_Inspection_Record_333_2026.docx/views/xlqpmvcznaert, hxxps://globaldocumentsharingcenter[.

]com/Full_Unboxing_Process_Inspection_Record_333_2026.docx/views/zxczcczlkcjaslda, hxxps://documentcloudlink[. ]com/Complete_Unboxing_And_Damage_Inspection.mp4/views/mxqvcznplrtei, hxxps://drive[.]careernetwork[.]co[. ]nz/download.php/Complete_Unboxing_And_Damage_Inspection?f=, hxxps://drbox[.]august-brokers[.]co[. ]nz/download.php/Package_Condition_Recordingmp4?f=, hxxps://customerreviewproduct[.

]com/Complete_Unboxing_And_Damage_Inspection.mp4/views/iOpLkJhGfDsAtp, hxxps://customersrespondedpositively[. ]com/Complete_Unboxing_And_Damage_Inspection.mp4/views/PqsTVwXyZatii, hxxps://cloudflare[.]carriernetworks[. ]top/?sharingcenterDelivery_Unboxing_Verification.MP4, hxxps://drbox[.]august-brokers[.]co[. ]nz/download.php/Package_Condition_Recordingmp4?f= - IP address: 103[.]153[.]74[.

]201, 103[.]82[.]26[. ]183, 103[.]82[.]20[. ]17, 103[.]179[.]189[. ]169, 103[.]179[.]188[.

]9, 103[.]179[.]188[. ]216, 103[.]179[.]188[. ]236, 103[.]82[.]20[. ]60, 103[.]153[.]75[.

]131 - File: SHA-256 2e05d97ed7bfabea8f7370ba627e0705ec2c0fbf3974b39437e9d95d45d1a76d Full_Unboxing_Process_Inspection_Record_2026_1412621.pdf.exe, PureRAT, SHA-256 e55412555b4699c6d3ce2ac60df81eb1ee0d5aa412a303555c8f64037d5633d0 AppVIsvSubsystems64.dll, PureRAT, SHA-256 c1a2b48d4f639b46cf6cde8322666f0991531ef32ffe571140418ae40342ffe8 PureRAT payload, SHA-256 8cd271f946d84423c554992eb0176be395cdd7bf6179efe1822759d019c94f34 Complete_Unboxing_And_Damage_Inspection.exe, Type 1, SHA-256 eb20fb4e1de2844717270e600af05abac06b359be711eabf14a3d91bfbf966e6 AppVIsvSubsystems32.dll, Type 1, SHA-256 ad0c3182b18b5d7ba8771d830f4d51b4ada7e26f8d05223f4379e6312aba65fa PureLogs, Type 1, SHA-256 9e54486f204d8c9ff9c539c5b2119b79a6da21e3dfdb7f51ee8ebba62f851174 Full_Unboxing_Process_Inspection_Record_9862_2026.exe, Type 2-1, SHA-256 af4ee79582992e348a8739579da478d50daccbaa6ec97420311916a2ac0fc503 AppVIsvSubsystems64.dll, Type 2-1, SHA-256 afdb4a8384812e907a73b59df0fb303af2ba94994b5f4bbb66a51ce2b04e7c32 Full_Unboxing_Process_Inspection_Record_9862_2026.exe, Type 2-2, SHA-256 1b5cf526a28bae9283acf91b2c0ccae3163d24706e40d9a0aea38c4b79e65d36 AppVIsvSubsystems64.dll, Type 2-2, SHA-256 567fc6e35bb45a6ecf5d870e454c813613032078a5ba01fcd374544930598703 propsys_1f520a24.cache, Type 2-2, SHA-256 719f689b34f47be8ca105ce8484948474dafde0e106bab599e4a89326070c3d0 Delivery_Unboxing_Verification_Details.exe, Type 3, SHA-256 aee2aefbc73dbf5f65e455ef18e74e158290e21803bf3dd64a05d087bfaceb18 uxtheme.dll, Type 3, SHA-256 5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946 BootRepair.sys, Type 3, SHA-256 afd31f096c93776888454e1321654477cfd97eb0c6a75bea624d8f7d891e0a61 PureLogs, Type 3, SHA-256 SHA-256 PureLogs, Type 3, SHA-256 __ENTITY_18__ PureLogs, Type 3, SHA-256 __ENTITY_19__ PureLogs, Type 3, SHA-256 __ENTITY_20__ PureLogs, Type 3, SHA-256 __ENTITY_21__ PureLogs, Type 3, SHA-256 __ENTITY_22__ PureLogs, Type 3, SHA-256 __ENTITY_23__ PureLogs, Type 3, SHA-256 __ENTITY_24__ PureLogs, Type 3, SHA-256 __ENTITY_25__ PureLogs, Type 3, SHA-256 __ENTITY_26__ PureLogs, Type 3, SHA-256 __ENTITY_27__ PureLogs, Type 3, SHA-256 __ENTITY_28__ PureLogs, Type 3, SHA-256 __ENTITY_29__ PureLogs, Type 3, SHA-256 __ENTITY_30__ PureLogs, Type 3, SHA-256 __ENTITY_31__ PureLogs, Type 3, SHA-256 __ENTITY_32__ PureLogs, Type 3, SHA-256 __ENTITY_33__ PureLogs, Type 3, SHA-256 __ENTITY_34__ PureLogs, Type 3, SHA-256 __ENTITY_35__ PureLogs, Type 3, SHA-256 __ENTITY_36__ PureLogs, Type 3, SHA-256 __ENTITY_37__ PureLogs, Type 3, SHA-256 __ENTITY_38__ PureLogs, Type 3, SHA-256 __ENTITY_39__ PureLogs, Type 3, SHA-256 __ENTITY_40__ PureLogs, Type 3, SHA-256 __ENTITY_41__ PureLogs, Type 3, SHA-256 __ENTITY_42__ PureLogs, Type 3, SHA-256 __ENTITY_43__ PureLogs, Type 3, SHA-256 __ENTITY_44__ PureLogs, Type 3, SHA-256 __ENTITY_45__ PureLogs, Type 3, SHA-256 __ENTITY_46__ PureLogs, Type 3, SHA-256 __ENTITY_47__ PureLogs, Type 3, SHA-256 __ENTITY_48__ PureLogs, Type 3, SHA-256 __ENTITY_49__ PureLogs, Type 3, SHA-256 __ENTITY_50__ PureLogs, Type 3, SHA-256 __ENTITY_51__ PureLogs, Type 3, SHA-256 __ENTITY_52__ PureLogs, Type 3, SHA-256 __ENTITY_53__ PureLogs, Type 3, SHA-256 __ENTITY_54__ PureLogs, Type 3, SHA-256 __ENTITY_55__ PureLogs, Type 3, SHA-256 __ENTITY_56__ PureLogs, Type 3, SHA-256 __ENTITY_57__ PureLogs, Type 3,...