April 2026 Report: Trojans and Phishing Lead Email Attachment Threats

May 13, 2026 · Original article ↗

Summary

April 2026 findings put Trojans at 47% and phishing at 39% of email-attachment threats; phishing rose from 21% the prior month. The report describes disguised attachments, credential-stealing pages, PDF links, and downloader malware.

Key points

The report identifies Trojans as the most common email-attachment threat at 47%, followed by phishing at 39% and downloaders at 10%.
Phishing’s reported share rose from 21% in the previous month to 39% in April.
Trojan attachments used double extensions or legitimate-looking filenames to trick recipients into opening them.
Phishing pages mimicked login or advertising pages to collect credentials; PDF documents also contained links to phishing sites.
Downloader files fetched additional malware from command-and-control servers after execution.
The report describes lures impersonating the Ministry of Unification, Yujin Technology, and Hyundai E&F.
FakePage activity rose from 0.7p in March to 1.1p in April; script-type malware distribution declined while Trojans increased slightly.

Article Details

Publisher: asec.ahnlab.com
Report Period: April 2026
Scope: Phishing email attachment trends, campaign lures, and malicious-file indicators.
Sample Size: Not disclosed
Key Statistics: Trojan attachments accounted for 47% of the identified threat types in April 2026.
Phishing accounted for 39%; its share increased from 21% in the previous month.
Downloader files accounted for 10% of the identified threat types.
On a six-month basis, FakePage activity increased from 0.7p in March to 1.1p in April.

Indicators of compromise

Type	Indicator	Context
MD5	`022ee27cd9682ad9163481c8475c2cf6`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`0d94615194b814b339a4ff6624eca249`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`2461f930c410d16f2baa5ce89981a618`	MD5 of a malicious file included among the collected samples with the highest detection counts.
MD5	`38c62aa85d5a56e30a51dea42ab25b6d`	MD5 of a malicious file included among the collected samples with the highest detection counts.
MD5	`3da94d43ee7e717cab61411a6bf3652c`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`445dae0606ebe8d2f6a3039bc1de33fd`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`4efb43640db69da9727cb345e8ec68fe`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`5f071b58343cc80ef4f50dab25e4e87b`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`6a78b581d24c1594a17845beae5ee37f`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`6aec2b4476bbd484050e882b8d15295b`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`6e31a9ef724fb32399ea7c4b3e2e2ff5`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`72ff2c8bf509e2b5e07e19d431ef1759`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`76ec5ed59228399e34a2cde4eb3b0086`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`7f3537d2da17230d6832419848bc192e`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`838ae48fb57ac075a6d12ef58fe73f08`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`97704db15c26e4ed3f565df0652798d2`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`a0eba195bef0cb949f8f5e7359e7595f`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`a118185fa98992eb2a96bedd0e82fce1`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`a76143f9389210e654e7b6294018f1c7`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`a8f4ea5c0ea0c7aadc4fe409552a3d41`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`d33f0f332f520d0a877f336bef2aa30d`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`e8e8d8a3f9a9e92282b1a2b660843a4a`	MD5 of a malicious file included among the collected samples with the highest detection counts.
MD5	`f1bb8c5346a0e54daac1bb46abfd67de`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`fa96bcb49a84e456e1417a184b4d2c9c`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`fc98754c49360bc180d94e0851d153e5`	MD5 of a malicious file included in the report's top-30 list by detection count.
MD5	`fede3b9deac06b64a267ebfdb75fb411`	MD5 of a malicious file included in the report's top-30 list by detection count.
URL	`hxxps[:]//fkp[.]su/Page/info[.]php`	URL identified in the report as C2 infrastructure in a campaign impersonating Yujin Technology.
URL	`hxxps[:]//www[.]seety[.]it/crinity/unikorea.go.kr/save[.]php`	URL identified in the report as C2 infrastructure in a phishing campaign impersonating the Ministry of Unification.

MITRE ATT&CK

T1036 · MasqueradingMalicious attachments used double extensions or legitimate-looking filenames to deceive recipients.T1105 · Ingress Tool TransferDownloader files fetched additional malware from a C2 server after execution.T1204.002 · Malicious FileThe campaigns relied on recipients opening attachments or clicking links to trigger malicious activity.T1566.001 · Spearphishing AttachmentPhishing emails delivered malicious content through attachments, including HTML, PDF, DOCX, and archive files.T1566.002 · Spearphishing LinkPDF documents contained hyperlinks that led recipients to phishing sites.

Countries

Koreaunder the subject lines of electronic tax invoice, email account update, DHL on-demand delivery, DHL Korea Shipment Confirmation, FedEx customs clearance notification, new electronic receipt, new bill arrival,

Industries

ManufacturingIn the Document type case, it impersonated a Korea manufacturing company “Yujin Technology” and induced users to open a PDF to check the unit price increase.OilIn the Compress type case, it impersonated “Hyundai E&F”, an oil company in Korea, and decompressed and executed a PDF to check a quote.