Fake IT support calls persuade employees to install Havoc malware on company systems
Huntress researchers describe a campaign that combines spam floods, browser disruption and fraudulent IT support calls to make employees initiate a compromise. Attackers use remote access, disguised repair files and DLL sideloading to deploy a modified Havoc C2 agent.
What We Know
Attackers are increasingly manipulating employees rather than directly exploiting software flaws, experts warn. Research from Huntress describes a campaign that uses deliberately crashed browsers and alarming security messages to push users toward a supposed repair.
The disruption creates urgency and gives criminals an opening to contact employees while posing as internal technical support.
From a spam flood to a fraudulent repair
The attack begins with a flood of spam in the victim's mailbox. A caller then claims to represent IT support and says the spam or browser malfunction requires immediate computer maintenance. In many observed cases, this impersonation made the instructions appear credible and routine, pressuring employees to cooperate.
Rather than relying on automatic malware delivery, the attackers guide users through actions that initiate the compromise. These include approving remote access sessions, installing remote administration software such as AnyDesk, pasting commands into system prompts or running scripts presented as diagnostic fixes.
During remote sessions, the attackers open a browser and direct victims to a fraudulent Microsoft-themed interface hosted on cloud infrastructure. Users are told to sign into a fake “Outlook Antispam Control Panel” and download an “Antispam Patch”. The download is actually a disguised archive containing components for the next attack stage.
Disguised files deploy a modified Havoc agent
Executing the supposed repair files causes a staged payload to reconstruct the malicious chain locally. It unpacks files resembling legitimate software components, including runtime libraries and executable utilities. A binary named ADNotificationManager.exe triggers the next phase after installation.
The attackers then rely heavily on DLL sideloading: malicious dynamic libraries are placed beside legitimate files so that harmful code runs while genuine applications continue operating normally, without immediately producing obvious warning signs.
The final payload is a modified agent derived from the open-source command-and-control framework Havoc C2. The researchers contrasted the outcome with older scams ending in a $300 gift card purchase: this campaign instead leaves a modified Havoc C2 framework embedded in the victim's environment.
In one case, an intruder moved from the first compromised computer to nine additional endpoints within roughly eleven hours. That speed indicates direct operator control rather than malware automatically spreading through vulnerabilities. Remote management tools and scripted payloads helped the attacker maintain persistence and move between connected systems.
The researchers warn that the campaign illustrates how social interaction, rather than technical flaws, can give attackers a route past firewall defenses.
