SHADOW-VOID-042 Impersonates Trend Micro in Phishing Campaign to Breach Critical Infrastructure

A new analysis details a targeted spear-phishing campaign attributed to the group tracked as SHADOW-VOID-042, which impersonated Trend Micro to breach defence, energy and chemical organisations, as well as to infiltrate Trend Micro and its subsidiaries using the vendor’s branding as a lure.

The operation, reported to have occurred in November 2025, relied on an urgent security advisory to coax recipients into visiting a decoy site designed to mimic Trend Micro’s corporate style, masquerading under the banner “TDMSec”. Researchers noted that the campaign used a multi-stage approach tailored to each target machine, delivering intermediate payloads to a subset of targets.

While the activity in November forms part of a broader operation linked to an October 2025 campaign, the relationship between SHADOW-VOID-042 and the hack group Void Rabisu is not definitively confirmed, with no final payload observed in Trend Micro’s telemetry. One recovered exploit targeted CVE-2018-6065, a Chrome vulnerability, though more recent exploits were likely used in the actual campaign.

According to Trend Micro, the attackers deployed JavaScript exploits and routed victims through a Cloudflare‑impersonating landing page before delivering the malicious payload.