Hackers Hide Malware in Nested macOS-Style Folders to Evade Scans

Hackers are increasingly adopting stealthy delivery techniques, and a newly uncovered spear-phishing campaign shows how nested macOS-like folder structures can be abused to evade detection while deploying advanced malware.

The phishing email carries a ZIP attachment named “常州大学2026年《国家学生体质健康标准》测试通知最终版.zip,” posing as an official university notice. The social engineering is unusually precise: failure in this fitness assessment directly affects graduation eligibility, creating urgency that pressures students and faculty to open the file.

Key targets include universities, government-affiliated academic bodies, sports departments, administrative staff, and students required to complete fitness assessments.

The attack begins with a spoofed email sent via a 163.com account, impersonating university communication. Once opened, the ZIP archive presents a decoy document that closely replicates official notices, complete with real staff names, contact numbers, and institutional seals elements that make verification difficult for victims.

Inside the archive:

• A deceptive LNK file disguised as a PDF acts as the initial trigger.
• Four layers of nested directories mimic macOS metadata structures to hide malicious components from scanners.

This layered design reduces visibility during both automated scanning and manual inspection.

Seqrite Labs said in a report shared with GBhackers, identified a highly targeted spear-phishing operation aimed at China’s education sector, specifically Changzhou University. The attackers leveraged a culturally and institutionally relevant lure tied to the mandatory 2026 National Student Physical Fitness and Health Standards testing cycle.

Multi-Stage Execution

The infection chain progresses through several stages:

Stage 1: LNK Execution

The LNK file executes a hidden VBScript using explorer.exe, a living-off-the-land technique that avoids triggering security tools that monitor script interpreters.

Stage 2: VBScript Loader

A lightweight script named chromedo.vbs orchestrates execution. It opens the decoy PDF while silently launching the next payload. A short delay ensures the document appears legitimate before malicious activity begins.

Stage 3: DLL Sideloading

The script launches a legitimate Bandizip executable from a hidden directory. A malicious DLL Sideloading (ark.x64.dll) is placed alongside it, exploiting Windows DLL search order to load attacker-controlled code within a trusted process.

The malicious DLL employs advanced anti-analysis techniques:

• Debugging checks using GetTickCount, IsDebuggerPresent, and CheckRemoteDebuggerPresent.
• Encrypted strings and runtime decryption using VirtualAlloc.
• Process enumeration to detect tools like Wireshark, Procmon, and Fiddler.

If analysis tools are detected, execution halts to avoid detection.

Once validated, the malware decrypts and loads an obfuscated SFX payload directly into memory. It then bypasses security controls such as AMSI and ETW before deploying a final-stage Cobalt Strike Beacon.

Notably, the entire payload chain operates in memory, leaving minimal forensic artifacts on disk.

Nested macOS-Style Folders

Researchers linked multiple samples through shared artifacts, including reused machine IDs in LNK files and consistent use of Bandizip as a living-off-the-land tool.

Command-and-control communications were traced to 60.205.186.162, hosted on Alibaba Cloud (AS37963), with domains like lysander[.]asia. Infrastructure analysis revealed ties to Chinese hosting providers and services such as HiChina and Feishu, suggesting a China-based operational footprint.

Seqrite Labs attributes the campaign, dubbed “Operation Dragon Whistle,” to threat actor UNG0002 with medium-high confidence. The group shares strong tactical overlap with a previous campaign known as Operation Cobalt Whisper.

This campaign highlights a growing trend: attackers combining high-fidelity social engineering with deeply obfuscated delivery mechanisms. The use of nested folder structures, legitimate software abuse, and in-memory execution demonstrates how modern threats evade traditional detection while maintaining operational stealth.

Organizations, particularly in education sectors, should strengthen email filtering, restrict execution of LNK files, and monitor for abnormal use of legitimate tools like archive utilities to reduce exposure to such attacks.

IOCs

File Name	SHA256
常州大学2026年《国家学生体质健康标准》测试通知最终版.zip	e7aff6a55a7866776272d9913dfbf9d7db33fc9de6aced22f2a195feebb0e85f
常州大学2026年《国家学生体质健康标准》测试通知.pdf	fe11b199ada23d5ac25efc4215e67f4ff617ccb4d429eb64412072687367ca1c
常州大学2026年《国家学生体质健康标准》测试通知.pdf.lnk	cd99e83d241cfbb41bfcd0bc622a87d16268e710ca7d736d0c5f44774e0056e2
Email	eb14d9e35a3bf0a933297f861bee0be9e6b9061fe4573a81ac92b71d55b6474f
Bandizip.exe	c937eca7c4c9b98df9257d986e666d25411aac5fa39d21f7018dd2e1663f0c76
ark.x64.dll	35a478f53f64bd412f374c65360fdba0518749537193669a8fe08d14bed65a2a
Cobalt Strike Beacon	ed7087e3afba4b320bdf04f32d3a6c567effd3d18a97682968e567000e70b335

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.