The Art of the Long Con: Lessons from the MixShell Malware Campaign

Not every cyberattack is a smash-and-grab operation. Some are patient, calculated, and deeply manipulative — more like a long-running confidence scam than a quick hack. Social engineering attacks are evolving, especially with AI becoming so advanced and accessible.

The recent ZipLine campaign, which used the stealthy MixShell malware, is a perfect example. Instead of blasting out mass phishing emails or impersonating a foreign prince, these attackers lured their victims into starting the conversation. Over weeks, they built rapport through convincing correspondence, only to deliver a devastating payload when trust was at its peak. This blog will dive into the tactics used in the ZipLine attacks, and how companies can prepare against the rising threat of advanced long-con social engineering attacks.

The Psychology Behind the Long Con

In 2024, human error was tied to 95% of data breaches, according to a study by Mimecast. This is why bad actors employ social engineering strategies. Social engineering attacks work because they target people — not systems. Long con tactics go a step further. They invest weeks or even months into communicating with their target before attempting to make an attack. The messages they use are polished – not like the usual typo-ridden scam emails we are used to in phishing attempts.

Moreover, these attackers make themselves seem credible. They mimic the legitimate business processes we are used to seeing, such as sending non-disclosure agreements (NDAs), sales orders, or other seemingly innocent documents that could reference real industry events. The goal? Lower the target’s guard until the malicious action feels like just another step in an already trusted relationship.

The ZipLine Campaign: Social Engineering in Action

Unlike typical phishing campaigns that send malicious emails en masse, the ZipLine malware campaign took a reverse approach. 

Step 1: Victim-Initiated Contact 

The attackers targeted corporate “Contact Us” forms. After receiving the form submissions through their public-facing website, the victims unknowingly reached out first, in many cases thinking that the person reaching out via the ‘Contact Us’ was a sales lead. Additionally, bad actors often posed as a ‘real customer,’ even going so far as to spoof emails or use other people’s names to appear more legitimate.

Step 2: Relationship Building

Next, the attackers engaged in long, seemingly genuine business exchanges. This could be anything from requesting pricing on a product or service, or asking relevant questions. 

Step 3: The Bait

After building a strong and friendly relationship with the victim, the attacker then would then send a ZIP file disguised as an NDA, sales order or project brief, laced with a malicious shortcut (.lnk) file. This file contained the MixShell malware.

Step 4: The Hook

The last step in their operation was deploying the MixShell malware. When the victim unknowingly opened the malicious file, the shortcut would trigger a PowerShell command that deployed MixShell directly into system memory, bypassing many antivirus solutions.

This patience-based strategy allowed attackers to slip past many of the defenses designed to stop quick-hit phishing attacks.

Understanding MixShell: The Weapon Behind the Con

MixShell isn’t your run-of-the-mill malware. It’s a powerful, memory-resident backdoor with a toolkit designed for stealth. It runs entirely on memory, which means that it is able to evade many of the key systems that detect malware because it leaves minimal traces on disk. It also uses techniques like Component Object Model (COM) hijacking to survive reboots, meaning that it is persistent.

Additionally, MixShell communicates via DNS TXT records with HTTP fallback. This makes it even harder to detect. With all of these tools to evade detection, MixShell is able to execute commands, move files, set up reverse proxies, and more. All of this combined with the trust built through long con social engineering, MixShell becomes even more dangerous — because victims often willingly execute it without ever knowing.

Why the Long Con Works in Cybersecurity

The MixShell campaign proves that cybercriminals don’t need to rush. In fact, the slower they go, the more convincing they become in many cases. Below are some of the reasons why this ‘long-con’ strategy is so effective: 

• Fewer red flags – The professional and polished communication looks legitimate. Many of these social engineering actors are smart and pose convincingly as a real business lead.
• Bypassing filters – The strategy of contacting victims through Contact Us forms on websites means that the victims unknowingly are initiating contact with the bad actor. This means that the bad actors are able to avoid the usual automated email defenses that many organizations have in place.
• Psychological comfort – As many businesses are used to receiving inquiries via the Contact Us forms on websites, the familiarity and routine of the situation lower their suspicion. Without thinking, they may open the malicious files and deploy the MixShell malware, because of the familiarity of these types of exchanges via email. 

How to Defend Against the Long Con

Defending against this type of threat requires both technical and human countermeasures. Here are some ways businesses can protect themselves from this type of Malware campaign:

Zero Trust on Inbound Communications

Firstly, employing a zero-trust mentality is essential, even if a conversation starts on your own site’s contact form. Before opening any files, it is essential to verify the source through a secondary channel. This could be something like a LinkedIn message, phone call, or any other method to verify the contact’s real identity. Oftentimes, the bad actors will pose as another person in order to gain your trust.

Advanced Threat Detection

Use behavioral and AI-powered security tools that analyze file behavior, not just known signatures. AI-powered or behavioral analysis solutions can flag anomalies such as in-memory execution, unusual PowerShell activity, or unexpected network communications.

Archive Inspection

Before opening any type of files, especially from unknown sources, it is imperative to scan all compressed files and embedded shortcuts. Configure email gateways and endpoint protection to scan inside ZIP, RAR, and other archive formats before they’re opened. Additionally, it can be helpful to block shortcut (.lnk) files and other potentially dangerous formats unless explicitly required for business purposes.

Security Awareness Training

Perhaps the most important method of defense is educating employees. Security awareness training and phishing simulation attacks can help prepare employees to recognize the red flags that come with social engineering attacks. A well-trained employee will know that even these long-term, “friendly” communications can still be malicious.

Here are some great resources on Security Awareness Training:
A Step-by-Step Guide to Email Penetration Testing
Phishing Simulations – Best Practices
4 Elements of a Successful Security Awareness Training Program

Strict File Execution Policies

Lastly, create policies that limit who can run scripts, executables, and PowerShell commands to prevent worst-case scenarios.

Wrapping Up

The MixShell campaign is a sobering reminder that not all cyberattacks are loud or rushed.
Some unfold like a patient, professional scam — earning trust before striking. In an age where digital interactions feel as routine as breathing, it’s critical to remember: trust is earned, but in cybersecurity, it must always be verified.