'ZipLine' Phishers Flip Script as Victims Email First

A financially motivated threat actor is flipping the phishing playbook by getting victims to make the first email contact, rather than the attacker initiating the exchange, a tactic linked to the ZipLine campaign tracked by Check Point Software. The operators allegedly hit company Contact Us forms under pretexts such as partnership inquiries, then craft credible, professional emails over weeks before delivering a weaponised zip file.

Embedded in the archive is a malicious LNK file that launches a PowerShell command to extract a second script, with the payload designed to run in memory and establish long-term persistence through registry changes and reactivation if the LNK payload is cleared. Check Point notes that the same approach is used across dozens of organisations in several sectors, with abandoned or dormant domains dating from 2015 to 2019 providing cover for the operation and helping bypass security filters.

The campaign is said to involve domains that mirror legitimate US-based businesses and exploits the trust built by genuine business interactions to spread the MixShell in-memory implant.