Chinese Mustang Panda Used Fake Diplomatic Briefings to Spy on Officials

In late December 2025–mid January 2026, Dream Research Labs uncovered a Mustang Panda campaign that used spoofed diplomatic briefings (malicious PDFs) to target government officials and international diplomats across Asia and Eastern Europe; the PDFs triggered a PlugX downloader variant (DOPLUGS) which used DLL search-order hijacking and PowerShell to stage additional surveillance tooling, employing custom encryption and loader techniques to remain stealthy.