Alerts About a New Phishing Attack Using Corrupted Files

The cybersecurity landscape is constantly evolving, and cybercriminals are developing increasingly sophisticated techniques to bypass protective barriers. This time, a novel attack using deliberately corrupted Word documents is raising alarms in the industry.

The Attack Mechanism

This attack exploits Microsoft Word’s file recovery functionality. The corrupted documents are distributed as attachments in phishing emails. At first glance, these damaged files seem harmless and manage to evade antivirus and analysis platforms like traditional sandboxes.
The most concerning aspect is that despite their corruption, the documents are recoverable when opened in Microsoft Word, triggering its automatic recovery functionality. This capability allows attackers to introduce malicious code into vulnerable systems without being initially detected by users or security tools.

Why Do Antivirus Tools Fail?

The deliberate corruption of the files makes it difficult for security solutions to identify their real type. When uploaded to platforms like VirusTotal, they often receive a “clean” or “not found” status, increasing their effectiveness as an attack tool.
Additionally, the design of these documents exploits a technical gap: many security solutions are not prepared to handle files that do not conform to standard formats. This allows attackers to conceal their intentions until it is too late.

How Researchers Detected the Threat

Threat analysis teams like ANY.RUN have managed to mitigate this issue. Their interactive sandbox allows these files to be opened and analyzed directly in their corresponding programs, identifying suspicious behavior that traditional antivirus solutions overlook. This proactive approach makes a crucial difference in combating such threats

Implications for Businesses

This attack highlights the need to strengthen cybersecurity measures in companies. Emails remain one of the main entry points for attacks, and relying solely on spam filters and antivirus is no longer enough.
It is crucial to implement advanced monitoring solutions, educate employees on phishing tactics, and adopt tools that combine interactive analysis with AI capabilities to detect anomalies.

Recommendations for Users and Businesses

The discovery of this attack reinforces the importance of adopting a comprehensive cybersecurity approach. As attackers innovate, so must our ability to adapt and protect ourselves. Only through collaboration among experts, businesses, and users can we mitigate the risks of emerging threats.