Ramadan Discount Scam Turns Dangerous: Sophisticated Malware Campaign Targets Middle East Retail Shoppers

This article examines a multi-stage malware campaign that targets users in the Middle East by taking advantage of seasonal shopping behavior during Ramadan. The attackers rely on a fake promotional document that appears to offer discount coupons and prizes from well-known retail brands.

At first glance, the document looks harmless and even convincing. However, once the user enables macros, it silently triggers a chain of actions that eventually leads to full system compromise.

The attack is technically advanced. It avoids traditional detection methods by compiling malicious code directly on the victim’s system and using legitimate Windows tools to execute it. The final payload is a Remote Access Trojan (RAT) that gives attackers complete control over the infected machine, including file access, screenshots, and command execution.

Campaign Overview

The attackers use a phishing document themed around Ramadan discounts. The lure is designed carefully to match local expectations and consumer habits.

The document pretends to be associated with a popular coupon platform and promotes offers from large retail chains. It also promises a prize of around 2,000 EGP, which is a meaningful amount in the local context and helps create urgency.

Several factors make this campaign effective:

The timing aligns with peak shopping activity during Ramadan
The use of known retail brands builds trust
The content is written in Arabic, targeting a specific audience
The discount code appears realistic and believable

All of this increases the chances that a user will open the document and enable macros.

Initial Infection Vector

The infection begins with a malicious Microsoft Word document.

When opened, the file shows a message asking the user to enable editing and content. This is presented as a compatibility issue with older Office versions, which is a common trick used in phishing campaigns.

Once macros are enabled, the embedded VBA code runs automatically using the AutoOpen() function. From that point, the attack proceeds without any further user interaction.

Technical Breakdown of the Attack Chain

Stage 1 – VBA Macro Execution

The macro performs several preparatory steps:

Checks if the system is already infected
Creates a temporary working directory
Writes a large, obfuscated C# source file to disk
Uses the system’s .NET compiler (csc.exe) to compile the code into an executable

What stands out here is that no precompiled malware is dropped. Instead, the code is built locally on the victim’s machine, which makes detection much harder.

After compilation, the temporary files are removed, and the newly created executable is launched silently.

Stage 2 – C# Loader

The compiled executable acts as a loader.

Its main job is to:

Decrypt hidden configuration data (such as command-and-control URLs)
Contact a remote server to fetch the next payload
Assemble the payload on the victim’s system using ilasm.exe
Execute it via rundll32.exe

The encryption scheme used here is intentionally non-standard. It relies on Rijndael with custom parameters and partial key storage, forcing the program to reconstruct the full key at runtime. This adds another layer of difficulty for analysts trying to reverse the malware.

Stage 3 – Remote Access Trojan (Ftu4You)

The final payload is a fully functional RAT.

Once active, it establishes communication with a command-and-control server and registers the infected system using detailed system information such as:

CPU and hardware identifiers
Username and hostname
Operating system details
System uptime

After registration, the malware continuously polls the server for commands.

Capabilities include:

Remote shell access
Screenshot capture
File browsing and manipulation
Uploading and downloading files
Session management

One particularly notable feature is how data exfiltration is handled. Instead of sending files directly to the attacker’s server, the malware uploads them to AWS S3 using pre-signed URLs. This allows the traffic to blend in with legitimate cloud activity and bypass many security controls.

Evasion and Anti-Detection Techniques

The attackers use several techniques to avoid detection:

On-device compilation: No static malware binary exists beforehand
Use of legitimate tools (LOLBins): Tools like csc.exe, MsBuild.exe, and rundll32.exe are used to execute malicious code
Fileless-like behavior: Temporary files are deleted quickly after use
Obfuscated encryption: Custom cryptographic methods hide configuration data
Cloud-based exfiltration: Data is sent through AWS instead of attacker infrastructure
User-agent spoofing: Malware mimics browser traffic

These methods significantly reduce the chances of detection by traditional antivirus and network monitoring tools.

Indicators of Compromise (IOCs)

Domains

article-learning[.]com
article-learning[.]xyz

Files and Paths

C:\Users\<user>\quanta.exe
%DOCUMENTS%\quantum<N>.dll
%USERPROFILE%\msid.txt
%USERPROFILE%\screenshots\

Processes

WINWORD.EXE spawning csc.exe
rundll32.exe executing non-standard DLLs

These indicators can be used for detection and threat hunting across enterprise environments.

Detection and Mitigation Recommendations

From a defensive perspective, several controls can help identify or stop this attack:

Monitor Office applications spawning compilers or scripting engines
Block or flag unusual use of rundll32.exe with user directory DLLs
Detect creation of suspicious files like msid.txt
Inspect outbound connections to suspicious domains
Monitor unusual AWS S3 upload activity from endpoints
Apply strict macro policies in Office documents

Organizations should also consider restricting the use of built-in compilers and scripting tools where possible.

CyberP1 Opinion

This campaign shows a clear shift toward more adaptive and stealthy attack methods. Instead of relying on traditional malware delivery, the attackers are using the victim’s own system to build and execute the payload. That alone makes detection much more difficult.

The use of a culturally relevant theme like Ramadan is not new, but in this case, it is executed very effectively. The attackers clearly understand the target audience, including language, shopping behavior, and trusted brands.

What stands out the most is the combination of techniques:

Local compilation to evade signatures
Legitimate system tools to avoid suspicion
Cloud services to bypass network monitoring

This is not the work of a basic phishing group. It reflects a higher level of planning and technical capability.

From a defensive standpoint, this kind of attack highlights the limits of traditional security tools. Signature-based detection alone is not enough. Behavioral monitoring, endpoint visibility, and strict control over macro execution are becoming essential.

In our view, similar campaigns are likely to increase, especially around major regional or cultural events. Organizations operating in targeted regions should treat seasonal phishing campaigns as high-risk and prepare accordingly.