Phishing Page Uses File Converter To Spread RedLine Stealer

## Executive summary A phishing site impersonating the Convertio online file-conversion service distributes a ZIP containing a malicious .lnk that fetches BAT scripts and an EXE; the scripts add Windows Defender exclusions via PowerShell and execute a payload identified as RedLine Stealer, which harvests credentials, browser data, cryptocurrency wallets, and system information. The report includes technical indicators (file hashes, distribution URLs), a process tree, MITRE ATT&CK mappings, and defensive recommendations.