Fake Delivery Complaint Emails Deliver Malicious ZIPs to Japanese Companies

Cyber‑crime outfits have started weaponising routine business messages to spread malware, converting ordinary delivery‑complaint emails into a hidden infection channel. Security analysts note that messages claiming a damaged shipment or a refund request can look indistinguishable from genuine internal correspondence, yet a single click sends the victim to a fake download page that serves a malicious ZIP file.

The operation, which seems aimed at firms operating in Japan, uses familiar phrasing and layout to lower suspicion. Threat actors design the subject line and body to imitate typical vendor notices, often referencing a broken package, a missing invoice, or an urgent refund. The link is hidden behind an apparently benign URL that, once clicked, redirects to a spoofed portal that mimics a corporate file‑sharing service.

When the counterfeit portal loads, the user is asked to download an archive that purportedly contains the requested paperwork. In truth, the ZIP houses executable payloads capable of installing ransomware, remote‑access tools, or data‑exfiltration malware once opened. Because the delivery method mirrors a normal workflow, staff are more likely to ignore security warnings and run the file.

Researchers point out that this method expands the classic business‑email‑compromise (BEC) playbook by adding a direct technical infection step. By embedding malware in the phishing stage itself, attackers remove the need for later social‑engineering moves, speeding up the compromise process. The emphasis on Japanese‑language content indicates a focused campaign against regional supply‑chain partners and domestic companies that frequently manage cross‑border shipments.

Industry specialists caution that the emergence of such hybrid attacks highlights the need for layered defenses. Email gateways should be set to scan both attachments and URLs for known malicious signatures, while endpoint security must block execution of unknown archives. Moreover, security‑awareness training ought to stress verification of unexpected delivery‑related requests, even when the email appears to originate from a trusted vendor.

Organizations are urged to implement strict verification routines, such as confirming refund or damage claims via separate communication channels and restricting executable files in email attachments. Deploying multi‑factor authentication for email accounts can also diminish the risk of credential theft that often precedes these campaigns.

Although the present wave is concentrated on Japanese enterprises, the tactics can be readily adapted to other regions and languages. As attackers continue to merge social engineering with direct malware delivery, businesses worldwide may need to reevaluate email‑security policies and incident‑response plans to stay ahead of the evolving threat landscape.