In short: Mail.ru's anti-spam team detected a sharp surge in a new phishing tactic: 13% of all blocked emails over the past month contained password-protected RAR archives hiding malware. Messages pose as urgent business documents — contracts, invoices, official tax notices. Attackers include the archive password directly in the email body, so spam filters cannot scan the encrypted contents and recipients unwittingly unlock the threat themselves.
What happened
On August 11, 2026, Mail.ru's anti-spam team disclosed a major phishing wave targeting Russian users and businesses. Unlike classic attacks embedding malicious links, fraudsters now attach password-protected RAR archives and include the decryption key in the same email. The campaign peaked during Russia's tax and quarterly reporting season, when accountants and employees routinely receive dozens of documents by email each day.
The scale is significant: 13% of all messages blocked by Mail.ru over the past month fell into this category. ComNews reported that the service intercepted hundreds of thousands of such emails. Other Russian cybersecurity vendors observed similar activity during the same period.
How the attack works
A recipient gets an email written in formal business language — references to federal laws, a professional tone, and a request to review an attached document: an invoice, reconciliation act, or contract. A RAR archive is attached, and the password to open it is printed in the email body.
The recipient enters the password, the archive opens — but inside is an executable or script with a convincing name such as "Invoice_July2026.exe". If the user runs it, malware installs silently. It can steal saved passwords from browsers, capture session cookies, open a remote-access backdoor, or log keystrokes.
Why password-protected archives are such an effective trick
Standard spam filters work by scanning attachments for known malicious signatures. An encrypted archive stops them completely — no antivirus can see inside without the password. Attackers deliberately exploit this gap. As Mail.ru's security team noted: "Unlike classic phishing with suspicious links, malware hides inside password-protected archives, making files appear trustworthy to recipients."
During reporting season, when real archives with real documents are expected, the camouflage is especially convincing. Our security blog covers how social engineering continues to outpace purely technical defences.
What this means for you
Consequences depend on the specific payload, but common outcomes include:
- Password theft: stealers extract saved credentials from Chrome, Firefox, Edge, and mail clients;
- Session hijacking: stolen cookies grant account access without knowing the password;
- Remote access: a RAT (Remote Access Trojan) gives the attacker full control of your device;
- Corporate data exposure: if the infected device is on a corporate network, the malware can spread laterally.
The infection is typically invisible — malware runs silently in the background by design.
How to protect yourself
- Never run executables from email archives. Legitimate business documents use .docx, .xlsx, or .pdf extensions — never .exe, .bat, .cmd, .scr, or .js. An archive containing any of these is almost certainly malicious.
- Check the actual sender address, not just the display name. Fraudsters routinely spoof recognisable names while sending from unrelated domains.
- Treat a password in the same email as a red flag. A genuine business partner will not send an encrypted archive and its decryption key together in one message.
- Keep antivirus software updated — although encrypted archives complicate scanning, most payloads are still detected at execution time.
- Avoid opening suspicious attachments as an administrator — this limits the damage if you do run something malicious.
An additional layer of network privacy — LiMP VPN — encrypts all traffic between your device and the internet, hides your real IP address, and prevents third parties from seeing which servers you connect to. A VPN will not stop you from running a malicious file, but it reduces your visibility as a target and keeps your data protected in transit.