Hackers Hide Malware Payloads Inside Nested macOS-Like Folders to Evade Scanning

Operation Dragon Whistle is a targeted spear‑phishing campaign against Chinese universities that uses ZIP attachments with nested macOS‑like folder structures to hide LNK files; those LNKs execute a VBScript that opens a decoy PDF while launching Bandizip.exe which side‑loads a malicious ark_x86.dll, ultimately deploying an in‑memory Cobalt Strike beacon with anti‑analysis checks. Seqrite links the activity to a tracked actor (UNG0002 / related campaigns), documents IoCs (file names and hashes, filenames like Bandizip.exe, ark_x86.dll, chromedo.vbs, an email.eml), and notes C2 infrastructure hosted in an Alibaba ASN, recommending deeper archive inspection, email filtering for LNKs, and endpoint monitoring for DLL side‑loading and in‑memory beacon behavior.