The Reversed Phishing Attack: New Campaign Triggers Victims to Call Hackers

Check Point Research has exposed a new phishing campaign dubbed ZipLine that upends the usual social engineering order by prompting victims to initiate contact with the attacker. The campaign targets supply chain–critical manufacturing companies, delivering a custom in-memory implant called MixShell after a victim replies to a form submission, with the initial outreach coming via the targeted company’s public “Contact Us” form.

The attackers use domains that mirror credible U.S. company names and host malicious archives on Herokuapp[.]com, blending in with legitimate platforms to lower suspicion. The ZIP archives carry both legitimate-looking documents and a hidden LNK file that triggers a PowerShell loader, deploying MixShell, described as a stealthy shellcode payload using DNS TXT tunneling with HTTP fallback for C2.

MixShell supports file operations, reverse proxying, command execution and interactive sessions, with a PowerShell variant featuring anti-debugging and sandbox evasion. The campaign shows a geographic concentration, with more than 80% of identified targets based in the United States, and overlaps infrastructure artefacts linking ZipLine to a cybercriminal cluster tracked as UNK_GreenSec.