Mustang Panda APT Uses Hidden DLL and EnumFontsW to Launch Stealthy Tibet-Themed Campaign

A new phishing campaign analysed by malware researcher 0x0d4y reveals Mustang Panda’s evolving tactics, including a stealthy DLL side-loading chain disguised as a humanitarian decoy called “Voice for the Voiceless Photos.exe” and a hidden libjyy.dll. The initial infection arrives in a malicious ZIP containing the decoy and the hidden DLL, which is deliberately marked as hidden and system via the a, r, h, s attributes to evade Windows Explorer.

The DLL is loaded by the decoy using LoadLibraryW, after which Claimloader decrypts strings, creates persistence, and deploys the final stage, Publoader. Publoader then uses API hashing and a PEB-walking technique to dynamically load essential APIs, enabling stealthy execution without leaving readable traces, with EnumFontsW employed to trigger shellcode via a callback.

IBM X-Force identified the campaign in June 2025, noting it targets the Tibetan community for political purposes and leverages multi-stage loaders and registry and scheduled task persistence to maintain access.