Gone Phishing: An Analysis of a Targeted User Attack

Huntress investigators detail a phishing incident in which a user-received ZIP containing a decoy PDF and a malicious Windows shortcut launched mshta and PowerShell to download and execute a Go-based loader that unpacked and ran an XWorm RAT; the malware established persistence via a scheduled task and used obfuscation and BITS/Transfer.sh downloads to evade detection, illustrating the need to combine security awareness with EDR/MDR defenses.