'HoldingHands' Acts Like a Pickpocket With Taiwan Orgs

A sophisticated, ongoing phishing campaign targeting Taiwanese organizations uses tax- and government-themed lures and malicious ZIP attachments (containing files such as dokan2.dll, dxpi.txt, and MsgDb.dat) to deploy multistage malware — notably Winos 4.0, HoldingHands (Gh0stBins), and Gh0stCringe — for data theft, surveillance, and C2 activity; Fortinet has tracked the activity since January and reporting links it to a broader pattern of regionally focused, potentially state‑backed operations.