Fake FedEx invoice: the blank PDF that installs the Sirius backdoor
An email from “FedEx” says a tax invoice has been issued. A compressed attachment, a PDF inside, a blank page when you open it. Nothing serious, it seems. Yet according to Trellix’s research team, that blank page is enough to load a new backdoor into memory, named Sirius, that can take over the computer, listen through the microphone and survive a Windows reset.
The campaign Trellix described on October 26, 2026 targeted users in South Korea, in Korean. But the malware is set to run in about 88 countries, including Canada and the United States, and the fake FedEx invoice works just as well in English or French. Here is how to spot it and what to set on your computers.
The fake FedEx invoice, annotated
Red flags to recognize
- 1An invoice from a supplier you have no account with, or an unusual amount.
- 2A generic message, without your customer number or your contact’s name.
- 3A password-protected archive for a simple invoice: a real carrier points you to its portal instead.
- 4A PDF asking you to “allow” or “open” a program: always say no.
The content reproduces the characteristics Trellix described. Real FedEx notices are not at fault: the attackers are simply borrowing the brand’s reputation.
What happens behind the blank page
The PDF contains no invoice. It holds only a space character, and an instruction telling the PDF reader to launch PowerShell on open. The rest runs in memory, with no visible file:
What the employee sees
An empty page. It looks like a corrupt file, so they close it and move on.
What runs in the background (per Trellix)
Open
The PDF uses /OpenAction and /Launch actions to start powershell.exe in a hidden window, once the warning is accepted.
Decrypt
The script decrypts and decompresses a .NET loader directly in memory.
Blind
A second module disables Windows ETW logging to blind security tools.
Download
It fetches the final payload, zeus.dat, from the attackers’ server.
Disguise
Sirius hides inside a legitimate Windows process such as msbuild.exe or svchost.exe.
Control
Hidden remote desktop, webcam, microphone, keystrokes, clipboard, passwords and Chromium browser cookies.
Two capabilities go straight for money: Sirius steals browser session cookies, which let attackers into accounts without a password, and it swaps cryptocurrency wallet addresses copied to the clipboard for the attackers’ own. It also adds Microsoft Defender exclusions and deletes volume shadow copies, which hampers recovery.
Where Sirius hides so it can come back
Trellix describes unusually stubborn persistence. Some locations are classic; others are designed specifically to survive cleanup:
Persistence locations reported by Trellix
HKCU…CurrentVersionRun
Restarts at sign-in.
Classic
Scheduled task
Runs at every sign-in, with the highest privileges available.
Classic
Startup folder: WindowsUpdate.lnk
A reassuringly named shortcut.
Classic
HKCUEnvironmentUserInitMgrLogonScriptName
A logon.cmd script run at every sign-in.
Little known
C:UsersDefaultNTUSER.DAT
Every new account created on the computer inherits the infection.
Infects new accounts
C:RecoveryCustomizations*.ppkg
A provisioning package restored by the Windows reset.
Survives a reset
C:WindowsSetupScriptsSetupComplete.cmd
Runs with SYSTEM rights at the end of a Windows setup or upgrade.
Comes back after an upgrade
❌ Myth 1
“If the computer is infected, we’ll just click Reset this PC.”
✅ Fact 1
The Windows reset restores packages placed in C:RecoveryCustomizations. Sirius uses that to reinstall itself. An affected computer must be reinstalled from clean media, after backing up the data only.
❌ Myth 2
“A blank page is just a broken PDF.”
✅ Fact 2
Here the blank page is deliberate: the file exists only to launch PowerShell. An empty PDF from an unexpected sender should be reported.
❌ Myth 3
“Our antivirus would have caught a malicious file.”
✅ Fact 3
The chain stays in memory and disables Windows logging. You need an EDR that watches process behaviour, such as SentinelOne, and rules that stop a PDF reader from launching PowerShell.
The settings to apply on your Windows computers
Trellix’s first recommendation is to enable the Microsoft Defender attack surface reduction (ASR) rule that blocks Adobe Reader from creating child processes. Test it in audit mode, then switch it to block:
// ASR rule “Block Adobe Reader from creating child processes”
What each line does
- 1Run in a PowerShell console opened as administrator, or deploy through Intune or Group Policy.
- 2Adds the ASR rule using its official identifier (GUID), as cited by Trellix.
- 3AuditMode logs without blocking. After a few days with no false positives, change it to Enabled.
- 4Confirms the rule is registered.
This rule covers Adobe Reader. If your staff use another PDF reader, turn off its ability to launch external programs.
The other recommended measures
- ☐ Enforce PowerShell Constrained Language Mode with AppLocker or WDAC on computers that don’t need full PowerShell.
- ☐ Turn on PowerShell Script Block Logging (event 4104) and keep the logs.
- ☐ Alert when a PDF reader launches PowerShell, or a script launches msbuild.exe.
- ☐ Periodically check C:RecoveryCustomizations, SetupComplete.cmd and the UserInitMgrLogonScriptName key.
- ☐ Block or quarantine password-protected ZIP archives from outside senders.
- ☐ Train the accounting team: an unexpected invoice gets checked on the supplier’s portal, never through the attachment.
If someone already opened the attachment
Unplug the computer from the network without shutting it down, then call your IT support. From another device, change the passwords saved in the browser and revoke open sessions, because Sirius steals sign-in cookies: our article on Microsoft 365 session token theft explains why a password change alone isn’t enough. Double-check any payment address copied recently. Finally, reinstall the computer from clean media rather than resetting it.
Booby-trapped attachments are one trick among many; consent-based scams such as Microsoft 365 device code phishing skip the attachment entirely.
How NeoTech can help
Our cybersecurity services roll out ASR rules and PowerShell restrictions on your computers without getting in the way of work, the SentinelOne EDR watches process behaviour, and our automated 24/7 monitoring with on-call technician intervention flags a PDF reader launching PowerShell or new persistence on monitored computers.
Book your free cyber check
In 30 minutes, we check whether a booby-trapped PDF like this one could launch PowerShell on your computers, and which settings to apply first.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Trellix, Shashikala Piddannavar, Raymond Joseph Alfonso and Sagar Bade, “Unveiling Sirius Backdoor: A Multistage Fileless Campaign Disguised as FedEx Invoices” (October 26, 2026)
- Broadcom, protection bulletin “Sirius Backdoor distributed under the FedEx disguise”
- Cyber Security News, “Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and Evade Windows Security”
Photo: Gustavo Fring, Pexels (Pexels licence).