A new type of cyberattack is exploiting the trust users have in PDF files. Hackers are hiding malware behind links that appear to be normal PDFs, but actually lead to virtual hard disks. When opened, these disks can bypass security measures and infect computers, making it a serious threat for organizations and individuals alike.

How the Attack Works

The scammers send emails that don’t attach a file directly. Instead, they include links to files stored on IPFS, a decentralized storage network. Because IPFS files can be accessed through regular web browsers, they are harder to block or detect.

These files are virtual hard disks that, when clicked, mount as a local drive on the victim’s computer. This tricks Windows into thinking it’s a normal disk, which can bypass some security features that block suspicious attachments.

Malicious Files Inside the Disks

Inside these virtual disks, there’s a Windows Script File (WSF) that claims to be a PDF. When the user opens this file, Windows executes the script automatically. This can then deploy malware, such as AsyncRAT, a remote-access Trojan that allows hackers to control the infected machine remotely.

This method makes it easier for malware to slip past traditional security checks, as the file appears harmless at first glance. Users often open such files without suspecting danger, which can lead to compromising the entire network.

How to Protect Yourself and Your Organization

Experts recommend that users enable file extension viewing on Windows. This helps identify suspicious files that might hide behind fake extensions or icons. Using reputable antivirus tools, like MalwareBytes, can also catch these threats before they cause harm.

Organizations should educate employees about the risks of opening unexpected links or files, especially those that seem unusual or are hosted on decentralized networks like IPFS. Regular software updates and security patches are also crucial to defend against new attack methods.

Overall, awareness and cautious behavior are key. As cybercriminals develop more sophisticated ways to disguise malware, staying informed helps prevent falling victim to these hidden threats.

Inspired by

• https://www.computerworld.com/article/4128863/pretend-disk-format-pdfs-harbor-new-dangers.html

Sources

• malwarebytes.com
• securonix.com