Hackers target Afghan government workers with fake correspondence from senior officials

Seqrite researchers uncovered a spear-phishing campaign dubbed "Nomad Leopard" targeting Afghan government employees with decoy documents impersonating the prime minister’s office; opening the document installs FalseCub, a data-collection/exfiltration malware. The actor used GitHub as temporary payload hosting and uploaded government-related lure documents to Scribd, with an alias linked to Pakistan; Seqrite assesses the actor as regionally focused with low-to-moderate sophistication and likely an individual operator or small cluster.