Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and Evade Windows Security

Hackers are sending fake FedEx tax invoices to trick users into installing a stealthy backdoor on Windows. The malware, called Sirius Backdoor, hides inside a blank PDF and loads its main code directly into memory, which leaves very few traces on the hard drive.

The emails target people who handle bills and payments. They are written in Korean and use the subject line “[FedEx] A tax invoice has been issued.”

The message claims a tax invoice of 217,740 KRW is due soon. That sense of urgency pushes accounting staff to open the attachment quickly.

Campaigns that copy trusted names are common, and a fake Claude desktop app campaign shows how a familiar brand can lower a victim’s guard.

Researchers at Trellix identified the malware while investigating a priority customer escalation. Their Threat Response Team looked into an alert about an unexpected PDF running on a system.

What looked like a routine phishing email turned out to be a multistage campaign that delivered a previously undocumented variant of the backdoor. The Trellix report was published on October 26, 2026.

Hackers Use Fake FedEx Invoices

The email carries a ZIP archive named Fedex_tax_receipt.zip. Hiding the payload inside an archive, as seen in fake utility download campaigns, helps it slip past simple email gateway scanners.

The archive contains Fedex_tax_receipt.pdf, which appears blank when opened. That blank page is intentional, since the file exists only to run code.

Hidden commands called /OpenAction and /Launch start a PowerShell command as soon as the file opens. The victim must still approve the PDF reader’s security prompt, so the campaign depends on tricking the user one more time.

The PowerShell command does not download an EXE file. It decrypts an AES-encrypted, GZip-compressed block in memory and loads it as a .NET assembly.

That loader derives an RC4 key using SHA256 and rebuilds the next stage by keeping every third byte and discarding the junk bytes in between. Each stage exists only to unpack the next one, like nesting dolls, so the final code is never stored in plain form on disk.

Evasion, Persistence, and Defense Steps

The second-stage injector tries to blind endpoint security tools. It patches Event Tracing for Windows (ETW) in ntdll.dll, which cuts off a key data source for EDR products.

It then downloads the final payload, zeus.dat, from dubaitechnicalservice.ae and hides it inside trusted processes such as msbuild.exe or svchost.exe using Early Bird APC injection.

Tricks like these are increasingly packaged for sale, and malware crypter services that sell bypasses show how criminals can buy them.

Sirius is built to survive reboots and even system resets. With admin rights, it drops a provisioning package into C:RecoveryCustomizations and creates SetupComplete.cmd to run with SYSTEM rights during Windows setup.

Without admin rights, it writes updater.vbs to the Startup folder and prompts for elevation. It can also copy itself into System32 as user32.dll for DLL sideloading.

Once in control, the operator can open hidden desktops, use an embedded SOCKS5 proxy, capture webcam and microphone feeds, steal Chromium credentials, and swap cryptocurrency wallet addresses in the clipboard.

It also adds Defender exclusions and deletes Volume Shadow Copies. Trellix recommends enabling the Microsoft Defender ASR rule that blocks Adobe Reader from creating child processes, enforcing PowerShell Constrained Language Mode, and turning on Script Block Logging to watch Event ID 4104.

Security teams should also flag unusual process chains, such as a PDF reader launching PowerShell. Lessons from the AsyncRAT fake installer campaign apply here too, including reviewing Defender exclusions and scheduled tasks.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and Evade Windows Security appeared first on Cyber Security News.