Fake FedEx invoices deliver Sirius backdoor via PDF PowerShell loaders

Trellix says Korean-language fake FedEx invoices launch Sirius, which injects into Windows processes and can steal credentials.

Trellix describes a previously undocumented Sirius backdoor found in a customer investigation. Korean-language emails impersonate FedEx billing notices, attach Fedex_tax_receipt.zip, and use a PDF that starts hidden PowerShell only if the user accepts a reader prompt. Loaders decrypt and reflectively run .NET assemblies, fetch zeus.dat, and inject Sirius into a suspended process such as msbuild.exe or svchost.exe. The malware can persist on disk, patch ETW, steal Chromium credentials, watch webcams, proxy traffic, and alter clipboard crypto addresses, according to the reports. GBHackers says disk persistence means the infection is not entirely fileless; Cyber Security News describes the backdoor as loaded only in memory.