Winos 4.0 Malware Uses Weaponized PDFs Posing as Government Departments to Infect Windows Machines

Security researchers are tracking a high-severity malware campaign that uses weaponized PDF files to distribute the Winos 4.0 malware, with the threat actors impersonating government departments to lure users into opening the documents. The campaign, first observed in early 2025, has expanded from Taiwan to Japan and Malaysia as it evolves its techniques to evade detection, according to FortiGuard Labs.

The PDFs mimic official government documents, such as those from the Ministry of Finance, and contain malicious links that download the payload when clicked, with initial hosting on Tencent Cloud storage before shifting to custom domains. A multi-stage infection process uses legitimate-looking executables and DLL side-loading, and now leverages the Windows Task Scheduler to restart and run components, making detection harder.

HoldingHands has replaced Winos 4.0 as the main payload in newer variants, and the campaign includes antivirus checks to terminate if protections are found. IoCs include several domains, IPs and SHA256 values linked to the campaign, illustrating a persistent, region-spanning operation affecting Windows machines.