A Shortcut to Compromise: Cobalt Gang phishing campaign

**Executive summary:** In August 2019 the Cobalt Gang targeted financial institutions with spearphishing emails containing an IMG with a weaponized LNK that launched an obfuscated PowerShell (1.ps1); the script decoded and wrote a CobInt stager, used UAC bypass techniques (eventvwr.exe or fodhelper.exe) to execute it, and ultimately delivered Cobalt Strike beacons. The report includes hashes, delivery URLs (e.g. swift-customer.com, valorleads.com, safestaticfirefox.com), a victim SID, and a function-level analysis mapping the activity to MITRE ATT&CK.