markcardiff.tech:/reports/spam-bombing-vishing-fake-self-service-portal-malware.html
root@markcardiff:~/reports$ ./render incident-report --public --vishing --malware

Spam-Bombing, Vishing, and Fake Self-Service Portal Malware Campaign

Public-safe defensive report on a campaign combining spam-bombing, external support calls, a fake self-service portal, credential/code harvesting, and user-assisted malware execution.

Published 2026-09-24 UTC
Focus phishing / vishing
Payload user-assisted malware
Scope public-safe redacted

# Public Report Draft: Spam-Bombing, Vishing, and Fake Self-Service Portal Malware Campaign

Executive summary

A customer organization was targeted by a coordinated phishing and social-engineering campaign combining email spam-bombing, external collaboration-platform calls, a fake self-service portal, credential/code harvesting, and user-assisted malware execution.

The malicious portal was hosted from public cloud object storage and presented itself as a support or health-check workflow. The page encouraged the victim to download a file, copy an “activation” command, and run a sequence that extracted and launched a Windows executable from the user profile. Static analysis of the downloaded package identified a Windows executable and obfuscated JavaScript components with remote-control, command-execution, socket-tunnelling, local service, reconnaissance, and persistence indicators.

This activity should be treated as a high-severity intrusion attempt. Any user who visited the page, entered credentials or MFA-style codes, downloaded the package, or ran the copied command should be handled as potentially compromised.

Key takeaways

Attack overview

Observed flow:

  1. Users receive a high volume of unsolicited messages or notifications.
  2. External callers contact users through a collaboration platform and attempt to create urgency.
  3. Victims are directed to a fake self-service or health-check portal hosted on cloud object storage.
  4. The portal asks for authorization details and simulates progress messages such as connection, authentication, processing, and finalization.
  5. The user is encouraged to download a file presented as a patch or support artifact.
  6. The user is encouraged to copy and run an activation command.
  7. The copied command extracts the downloaded archive into the user’s AppData directory and launches a Windows executable with a JavaScript file argument.
  8. Extracted scripts indicate capability for persistence, command execution, local service exposure, socket handling, and outbound WebSocket communication.

Technical observations

The malicious page was a fake “Self Care Portal” / “Health Check” workflow. It contained configurable text, download links, a copy-to-clipboard function, and a two-stage credential/code submission routine.

The page’s copied command created a directory under the victim user’s AppData path, extracted the downloaded archive with Windows built-in archive tooling, and launched an executable with a bundled JavaScript component.

The archive was disguised with a non-executable extension and served with a misleading content type. Static inspection showed it was a ZIP archive containing:

The JavaScript files contained indicators consistent with:

Indicators of compromise

Note: Public indicators below intentionally omit the victim/customer-identifying brand string from URLs. Defenders should adapt these to their local telemetry using the original incident evidence available to their SOC.

File hashes

Malicious HTML page:

Downloaded archive:

Extracted Windows executable:

Extracted JavaScript components:

Network indicators

Observed C2 / infrastructure indicators in extracted scripts:

Host indicators

Paths and filenames:

Registry persistence:

Command and behavior indicators:

Defensive guidance

Immediate containment

Endpoint hunting

Prioritize searches for:

Network hunting

Prioritize searches for outbound connections to:

Also review suspicious localhost services or loopback connections involving:

Identity investigation

For any user who interacted with the portal:

ATT&CK mapping

Likely techniques:

Public-safe conclusion

This campaign demonstrates a mature social-engineering pattern: attackers combine notification fatigue, live human interaction, fake support tooling, credential capture, and user-assisted execution to bypass purely email-centric defenses. The strongest controls are layered: external-caller awareness, rapid user reporting, browser/download protections, EDR visibility into user-writable execution paths, identity session revocation processes, and detections for AppData execution plus Run-key persistence.

Organizations should treat similar “download this support tool and paste this activation command” workflows as high risk, especially when they follow spam-bombing or unsolicited external support calls.

Limitations

Public-safe report. Customer-identifying strings and sensitive case context intentionally redacted.