Hackers Abuse PowerShell, VBScript, and BAT Files to Deliver Xctdoor Backdoor

Cybersecuritynews •Tushar Subhra Dutta • June 18, 2026

A new wave of cyberattacks is targeting corporate employees through files that look exactly like legitimate job documents. Hackers are distributing malicious LNK files disguised as resumes, and the moment a victim opens one, the infection quietly begins. The attack is sophisticated enough to fool cautious users, since the file shows a believable resume while […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious LNK Files Disguised as Documents Deliver Fileless Malware Threat actors are distributing malicious LNK files disguised as privacy consent forms and resumes to deceive users into executing them. Once opened, these files execute obfuscated PowerShell commands that download and run additional payloads using fileless techniques. The attacks aim to steal information and establish a backdoor for persistent access. Organizations are advised to enforce strict verification of file extensions and monitor PowerShell execution logs, Task Scheduler activity, and outbound connections. Users should be trained to validate incoming files before opening them. The attacks exploit common user behavior, making them particularly dangerous. Current investigations are ongoing to assess the full scope of the impact and identify affected systems. No specific numbers or CVEs were reported in the articles. 2 sources 71

Extracted Entities

Hackers Abuse PowerShell, VBScript, and BAT Files to Deliver Xctdoor Backdoor

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (4)

Tools (2)