Open the wrong “PDF” and attackers gain remote access to your PC

DEAD#VAX is a phishing campaign that uses IPFS-hosted files masquerading as PDFs which are actually VHDs; when mounted they expose a WSF that executes and injects AsyncRAT shellcode into trusted, signed Windows processes to run entirely in memory, enabling credential theft, surveillance, and lateral movement. The report explains the infection chain, emphasizes stealthy in-memory execution and evasion techniques, and gives practical user guidance (show file extensions, verify attachments, use real-time anti-malware).