Hackers Exploit PDF Invoices to Target Windows, Linux, and macOS Systems

A recent discovery by the FortiMail Incident Response team has revealed a highly sophisticated email campaign targeting organizations in Spain, Italy, and Portugal.

This attack distributes a potent Remote Access Trojan (RAT) known as RATty, primarily affecting Windows systems, but also posing a threat to Linux and macOS environments where the Java Runtime Environment (JRE) is installed.

The campaign leverages the legitimate Spanish email service provider, serviciodecorreo.es, which is authorized to send emails on behalf of various domains, passing SPF (Sender Policy Framework) checks and bypassing email security filters with alarming ease.

- Advertisement -

This deceptive legitimacy, combined with advanced evasion tactics, enables attackers to deliver malicious payloads that grant them full control over infected systems, including the ability to execute commands, log keystrokes, access files, and even activate webcams or microphones.

Multi-Layered Evasion Tactics and Infection Chain

The infection chain begins with a seemingly innocuous email containing a PDF attachment disguised as an invoice, often bearing urgent language to prompt hasty action from recipients through social engineering.

Upon opening the PDF, users are instructed to download an HTML file named “Fattura” (Italian for “Invoice”) via a Dropbox link.

This file includes a basic “I am not a robot” verification before redirecting to a dynamically generated URL via Ngrok, a tunneling tool used to mask the attack’s origin.

Ngrok’s geo-based cloaking further complicates detection by serving harmless content (e.g., a Google Drive document) to users outside targeted regions like Italy, while delivering a malicious JAR file (FA-43-03-2025.jar) to victims within the specified geolocation.

This JAR file, hosted on legitimate platforms like MediaFire, contains the RATty malware, a Java-based RAT capable of cross-platform exploitation due to Java’s ubiquitous presence.

According to the Report, The campaign’s use of trusted file-sharing services and geo-fencing techniques significantly reduces early detection risks, as security systems and sandboxes often analyze from non-targeted locations, missing the malicious payload.

This multi-layered strategy, coupled with the abuse of legitimate infrastructures, underscores the increasing sophistication of malware distribution methodologies, making traditional security measures less effective against such targeted attacks.

Fortinet’s protective solutions, including FortiMail, FortiGuard services, and FortiSandbox, offer robust defenses by detecting and blocking these threats through antivirus signatures, content disarmament, and real-time anti-phishing capabilities.

Additionally, Fortinet emphasizes the importance of user education through Security Awareness Training (SAT) and phishing simulations to mitigate human error, a critical entry point for such attacks.

Indicators of Compromise (IOCs)

Below are the technical indicators associated with this campaign for reference and mitigation purposes:

Setting Up SOC Team? – Download Free Ultimate SIEM Pricing Guide (PDF) For Your SOC Team -> Free Download