Threat Actors Imitate Popular Brands in New Malware Distribution Campaigns

Threat actors are employing a rising smishing tactic that embeds trusted brand names into deceptive URLs and group messages to entice users to download malware, with familiar company names such as FedEx and Microsoft used in the links. Attackers place the brand name immediately before an @ symbol, followed by a non-affiliated domain, and combine this with deceptively aged hostnames and coordinated group texts to bolster legitimacy and boost infections over the past month, according to Unit42_Intel.

Victims who tap the links are redirected to download trojanized apps or installers that secretly install backdoors and credential harvesters. Some campaigns have used six to eight month‑old registered domains to evade reputation-based defences, and attackers have exploited RCS features to enhance message presentation on Android devices, including displaying logos and sanitised interfaces.

The installers behind these links deploy keyloggers and remote access tools such as Orcus RAT and Cerberus Android malware, capable of exfiltrating SMS messages, authentication tokens, and contact lists. Defence advice includes URL analysis, DNS-level blocking of new domains, and user education on subtle indicators of malicious links. 3 October 2025