PDF + Geofencing + Malicious LNK: Technical Analysis of a Brazil-Focused Campaig
PDF + Geofencing + Malicious LNK: Technical Analysis of a Brazil-Focused Campaign During a recent investigation, we analyzed an attack chain that combined three particularly interesting elements from a threat hunting perspective: a decoy PDF, geofencing, and a malicious LNK shortcut . The operational outcome was the expected one: the threat was blocked and the customer remained protected. Still, the case is worth a technical breakdown because it shows how a seemingly simple campaign can include selective payload delivery, abuse of legitimate Windows binaries, and basic techniques to complicate analysis. Observed Attack Chain The reconstructed attack flow was as follows: Email in Portuguese with a financial theme ↓ Decoy PDF with a “View Document” button ↓ Redirection to external infrastructure ↓ Next-stage component delivered only from Brazil ↓ Execution of an LNK shortcut with obfuscated commands ↓ Abuse of legitimate Windo...
