Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware

The BITTER espionage group is exploiting user trust by disguising malware inside convincing fake meeting invitations and event letters, using Windows disk images (VHDX), WebDAV links, and hidden shortcut files to bypass traditional security controls. The root cause lies in insufficient user awareness around suspicious file types and links, combined with permissive system configurations that allow mounting of arbitrary disk images and unauthenticated WebDAV connections. This matters because spear-phishing with novel file formats is an increasingly effective way to evade email and endpoint security tools that may not inspect VHDX containers or remote WebDAV-hosted payloads. Once PapRAT is installed, attackers gain persistent remote access, enabling espionage, data exfiltration, and lateral movement. Organizations must combine user education with technical controls to close the gap between what security tools inspect and what users are willing to click.