Confucius Hackers Hit Pakistan With New WooperStealer and Anondoor Malware

The Hacker News reports that the threat actor Confucius has been attributed to a new phishing-focused campaign targeting Pakistan, deploying malware families such as WooperStealer and Anondoor. Fortinet FortiGuard Labs researcher Cara Lin said that Confucius has long targeted government and critical industries in South Asia, using spear-phishing and malicious documents as initial access vectors.

One documented attack chain in December 2024 tricked Pakistan-based users with a .PPSX file to deliver WooperStealer via DLL side-loading, followed by a March 2025 wave using Windows shortcut (.LNK) files to unleash the WooperStealer DLL once again. An August 2025 campaign used another .LNK to sideload a rogue DLL that paved the way for Anondoor, a Python implant designed to exfiltrate device information and execute tasks such as taking screenshots and dumping Chrome passwords.

Fortinet noted that Anondoor had been documented earlier in July 2025 by Seebug’s KnownSec 404 Team, highlighting the group’s adaptability and ongoing evolution of its toolset.