Sophisticated Cross-Platform Malware Campaign Leveraging Weaponized PDF Invoices

 A highly coordinated and sophisticated email-based malware campaign has recently come to light, employing weaponized PDF invoices as the initial attack vector. This multi-layered campaign targets organizations across various sectors, aiming to compromise endpoints running Windows, Linux, and macOS — with the latter two at risk if the Java Runtime Environment (JRE) is installed.

At the heart of the campaign is a seemingly benign email purporting to contain a legitimate invoice. These emails are carefully crafted using social engineering techniques to pressure recipients into immediate action — leveraging urgency and credibility. What makes these emails particularly deceptive is that they successfully pass SPF (Sender Policy Framework) validation by exploiting serviciodecorreo.es, an email service configured as an authorized sender for multiple domains. This enables the attackers to spoof trusted domains with relative ease, increasing the likelihood of user interaction.

Attached to the emails are PDF files designed to appear as standard invoices. However, when opened, the document deceptively displays an error message about incorrect rendering and prompts the user to click a button — a tactic that initiates the infection chain.

The infection chain unfolds in multiple sophisticated stages. Once the victim clicks the button within the PDF, they are redirected to a Dropbox-hosted HTML file named Fattura (Italian for “invoice”). This HTML file presents a fake CAPTCHA verification ("I am not a robot") to lull the victim into a false sense of security and legitimacy.

Upon interacting with the CAPTCHA, the victim is further redirected to a URL generated by Ngrok — a tool that tunnels local services over the internet, effectively hiding the attacker's infrastructure. This use of Ngrok makes it difficult for defenders to trace or block the malicious servers.

One of the more sophisticated techniques used in this campaign is geolocation-based content filtering. If a user accesses the URL from within Italy — the campaign’s apparent primary target — they are served a malicious JAR (Java ARchive) file. In contrast, users from other locations receive a benign-looking invoice PDF hosted on Google Drive, imitating documents from legitimate entities like Medinova Health Group.

This geofencing strategy is designed to outmaneuver email security gateways and sandboxing systems, which often operate from data centers outside of target geographies. By serving benign content to these systems, the malware can evade analysis and gain a foothold in the actual target environment.

The final payload, delivered in a file named something innocuous like FA-43-03-2025.jar, contains a Java-based Remote Access Trojan (RAT) known as RATty. Because it is written in Java, this RAT can operate across platforms — affecting Windows, macOS, and Linux machines, provided JRE is available.

Once executed, RATty grants attackers full remote access to the compromised system. Capabilities include:

• Execution of system-level commands

• Keystroke logging

• Screen and webcam capture

• File browsing and exfiltration

• Microphone activation

This gives the attackers persistent and unrestricted control over the victim’s device, posing a serious risk to enterprise data and user privacy.

To further complicate detection and mitigation, the attackers make heavy use of legitimate cloud storage services, including Dropbox and MediaFire, to host malicious payloads. This abuse of trusted platforms helps the campaign blend into normal network traffic and evade filters that often whitelist such services.

This campaign exemplifies the growing complexity and cunning of modern threat actors. From the use of social engineering and trusted platforms to the implementation of geofencing and tunneling technologies, every element of the attack is carefully engineered for stealth and effectiveness.

Organizations should:

• Educate users on social engineering red flags

• Restrict the execution of Java-based files

• Monitor for unusual Dropbox/Ngrok usage

• Harden email gateways with deeper behavioral analysis

Fortinet’s discovery of this campaign underscores the need for continuous monitoring and adaptive defenses in the face of ever-evolving threats. As attackers increasingly employ cross-platform strategies, endpoint security must adapt to cover all potential vectors — including what appears to be nothing more than an ordinary invoice.