Hackers Deliver Sirius Backdoor via Fake FedEx Invoices to Bypass Windows Security

Attackers are distributing fraudulent FedEx tax invoice emails that deliver a stealthy Windows backdoor called Sirius Backdoor. The malware is concealed inside a seemingly blank PDF and loads its core components directly into memory, leaving minimal artifacts on disk.

The phishing messages are written in Korean and target employees responsible for payments and invoicing. The subject line reads “[FedEx] A tax invoice has been issued.” The email warns of an upcoming payment of 217,740 KRW to create urgency and encourage recipients to open the attachment quickly.

Using familiar brand names in lures is a common tactic; earlier campaigns that impersonated well-known products such as a fake Claude desktop app demonstrate how trust in a brand can lower a recipient’s guard.

Researchers at Trellix discovered this malware while investigating a priority customer escalation. Their Threat Response Team responded to an alert about an unexpected PDF executing on a system and identified a multistage campaign delivering a previously undocumented variant of Sirius Backdoor. The Trellix report was published on October 26, 2026.

How the FedEx invoice lure works

The phishing email includes a ZIP attachment named Fedex_tax_receipt.zip. Packaging the payload in an archive helps it evade basic email gateway filters. Inside the archive is Fedex_tax_receipt.pdf, which intentionally displays as a blank page—its purpose is solely to trigger code execution.

The PDF abuses hidden actions (PDF /OpenAction and /Launch entries) to execute a PowerShell command when the file is opened. The PDF reader’s security prompt still requires the user’s approval, so the campaign relies on social engineering to get the victim to accept that prompt.

The PowerShell command does not retrieve an EXE. Instead, it decrypts an AES-encrypted, GZip-compressed payload in memory and loads it as a .NET assembly. The loader constructs an RC4 key derived from a SHA-256 value and reconstructs the next stage by keeping every third byte and discarding the filler bytes between. Each stage unpacks the following stage in memory, so the final payload is never written to disk in plain form.

Evasion, persistence, and recommended defenses

The second-stage injector attempts to blind endpoint protections by patching Event Tracing for Windows (ETW) in ntdll.dll, removing a telemetry source relied upon by many EDR solutions. It then downloads the final payload, zeus.dat, from dubaitechnicalservice.ae and injects it into trusted processes such as msbuild.exe or svchost.exe using an Early Bird APC injection technique.

Such evasion and obfuscation techniques are commonly available commercially; malware crypters and bypass services make these capabilities purchasable to less skilled attackers.

Sirius is designed to survive reboots and even some system recovery operations. With administrative privileges, it drops a provisioning package into C:RecoveryCustomizations and creates SetupComplete.cmd, which runs with SYSTEM privileges during Windows setup. Without admin rights, the malware writes updater.vbs to the Startup folder and prompts the user for elevation. It can also copy itself into %SystemRoot%System32 as user32.dll to enable DLL sideloading.

Once established, an operator has wide-ranging capabilities: opening hidden desktops, operating an embedded SOCKS5 proxy, capturing webcam and microphone streams, harvesting Chromium-based browser credentials, and replacing cryptocurrency wallet addresses copied to the clipboard. The malware also adds exclusions to Microsoft Defender and removes Volume Shadow Copies.

Trellix recommends several mitigations: enable the Microsoft Defender Attack Surface Reduction (ASR) rule that prevents Adobe Reader from creating child processes; enforce PowerShell Constrained Language Mode; and enable Script Block Logging to monitor Event ID 4104. Security teams should also alert on unusual process chains—for example, a PDF reader spawning PowerShell—and routinely review Defender exclusions and scheduled tasks. Lessons from prior campaigns (such as the AsyncRAT fake installer) apply here as well.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, using hxxps or other transformations) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Provide your SOC with rich alert context to stop incidents quickly. Integrate threat intelligence from thousands of SOCs to improve detection and response.