X-Force identified a phishing campaign targeting Latin American users since March 2024, where emails impersonate legitimate entities like tax and utility services, urging recipients to click links for invoices or account statements.  Clicking the link redirects users in specific countries to a fake PDF icon while downloading a malicious ZIP archive containing an executable disguised as a PDF, which leverages urgency and exploits trust in official institutions to trick users into compromising their systems.  Sample emails impersonating SAT, and CFE For the first time, the phishing campaign targets users outside Latin America. The emails impersonate tax authorities like the South African Revenue Service (SARS) and leverage familiar tactics used in past Grandoreiro campaigns in Latin America.

Source: GBHackers