Hackers use fake NDAs to deliver malware to US manufacturers

Researchers uncovered a targeted phishing campaign that abuses corporate 'Contact Us' forms to engage victims over days, then send ZIP archives hosted on Heroku containing custom malware called MixShell disguised as NDAs. The operation targets U.S. industrial, manufacturing, semiconductor, biotech, aerospace and other firms, uses long-established fake domains to evade filters, selectively serves malicious payloads based on victim attributes, and shows infrastructure overlap with a cluster (UNK_GreenSec) linked to Russia-aligned cybercriminal activity.