Malicious PDFs Used to Install Remote Access Trojans

Cybercriminals behind the DEAD#VAX campaign are using a deceptive technique that disguises malware as ordinary PDF documents. 
 
 
Victims receive phishing emails that appear to contain routine business files such as invoices or purchase orders. 
 
However, clicking the link does not download a normal document.
 
Instead, the file is actually a virtual hard disk (VHD) hosted on the InterPlanetary File System (IPFS), a decentralized storage platform that attackers increasingly abuse because malicious content is harder to remove.
 
When opened on Windows, the file mounts as a virtual drive rather than launching a PDF viewer. 
 
Inside the drive is a disguised Windows Script File (WSF) that secretly installs AsyncRAT, a powerful remote-access Trojan.
 
The malware injects its code into legitimate Microsoft-signed processes such as RuntimeBroker.exe or OneDrive.exe, allowing it to run entirely in memory and evade traditional security tools.
Once installed, attackers can steal passwords, capture screenshots, access confidential files, and even spy through webcams.
 
Users should verify email attachments, enable file-extension visibility in Windows, and use updated real-time anti-malware protection to reduce risk.