APT-C-06 (Darkhotel) launched phishing attacks in April 2026 using a decoy document themed around North Korean Central Television to trick targets into downloading an application. By late May 2026, the campaign evolved to deliver malicious MSI installers via phishing emails. These MSI files execute VBS code that establishes scheduled tasks to download and execute PowerShell scripts. The PowerShell scripts retrieve subsequent payloads encrypted with ChaCha20 and ultimately deploy shellcode. This reflects a sophisticated multi-stage attack chain leveraging scripting and encryption for stealth and persistence. PowerShell usage has been a frequent tactic for this group since 2025.

The campaign targets high-value individuals and sectors such as corporate executives, defense, and electronics. Successful exploitation leads to execution of encrypted payloads and shellcode on victim systems, potentially enabling unauthorized access, persistence, and further compromise. The use of scheduled tasks and PowerShell scripts facilitates stealthy and persistent infection. However, no known exploits in the wild have been reported for this specific campaign as of the publication date.

No official patch or remediation is applicable as this is a phishing campaign leveraging social engineering and malware delivery. Organizations should focus on user awareness training to recognize phishing lures, implement email filtering to block malicious attachments (MSI files), and monitor for suspicious scheduled tasks and PowerShell activity. Endpoint detection and response solutions can help identify and block the execution of malicious scripts and shellcode. Since this is a targeted campaign, heightened vigilance in affected sectors is advised.