Malicious Multilingual ZIP Files Strike Banks and Government Offices

A sophisticated phishing campaign using multilingual ZIP files has emerged across East and Southeast Asia, targeting government institutions and financial organisations with unprecedented coordination, according to GBHackers. Security researchers identified 28 malicious webpages spread across three language clusters (Chinese, English and Japanese) that deliver ZIP and RAR archives disguised as tax invoices and other official documents.

The operation shows a uniform backend, with download.php and visitor_log.php scripts powering a centralised, automation-driven infrastructure, hosted largely by Kaopu Cloud HK Limited (AS138915) with servers in Tokyo, Singapore, Hong Kong, Thailand and Cambodia.

The multilingual setup expands the threat across Taiwan, Hong Kong, Japan, Indonesia, Malaysia and beyond, and researchers noted a shift from earlier campaigns that relied on Tencent Cloud, adopting a unified backend to test social‑engineering themes across regions.

A phishing domain, “zxp0010w[.]vip”, was observed on 4 June 2025, and the activity is described as evolving from Fortinet threat intelligence reports; network defenders should block discovered domains and monitor for similarly named new domains, while filtering ZIP and RAR attachments with job or finance related filenames.