Phishing and Social Engineering Campaigns Leveraging Trusted Channels and China-Linked Tradecraft

Multiple reports highlight social engineering-driven compromise rather than exploitation of software vulnerabilities, with attackers relying on trusted-looking communications and infrastructure to bypass defenses. One campaign described by X-Labs uses a “clean” initial business email (often passing SPF/DKIM/DMARC) that contains no direct malicious link, instead delivering a PDF attachment that leads victims through a multi-stage document chain. The chain leverages reputable cloud services—including Vercel Blob—to host intermediary PDFs that redirect to a Dropbox-impersonation credential-harvesting page, and then uses a Telegram bot as a collection point for stolen credentials, complicating detection and takedown.

Separately, researchers reported a targeted operation attributed to China-linked Mustang Panda (aka HoneyMyte) against government officials and diplomats, using fake diplomatic briefing documents themed as U.S./international policy updates to induce execution and install surveillance tooling, including PlugX (noted as a DOPLUGS variant). In parallel, U.S. reporting described HUMINT-style recruitment approaches tied primarily to China, where adversaries pose as recruiters/consulting firms on email and job platforms to elicit or purchase sensitive information from current/former U.S. government personnel—an espionage pathway that is adjacent to, but distinct from, the phishing/malware activity described in the other reporting.