The Confucius threat actor has launched a new phishing campaign targeting Pakistan, utilizing malware families like WooperStealer and Anondoor. Confucius, active since 2013 across South Asia, consistently targets government agencies, military organizations, defense contractors, and critical industries using spear-phishing and malicious documents as entry points. Recent campaigns have introduced Anondoor, a Python-based backdoor, showcasing the group’s evolving tradecraft. In December 2024, Confucius tricked Pakistani users into opening a .PPSX file, deploying WooperStealer through DLL side-loading. By March 2025, the group used Windows shortcut (.LNK) files to launch WooperStealer, again using DLL side-loading to extract sensitive data from hosts. August 2025 saw further use of .LNK files to sideload a rogue DLL, facilitating Anondoor’s deployment for device information exfiltration and additional command execution tasks. Confucius demonstrates adaptability, employing obfuscation techniques to evade detection and tailoring its toolset to shifting intelligence priorities. Fortinet highlights the group’s persistence and rapid tactical pivots, maintaining operational effectiveness. The campaign’s disclosure coincides with a recent report on the Patchwork hacking group’s infection sequence, involving malicious macros downloading .LNK files with PowerShell code for further payload delivery. This sequence establishes command-and-control (C2) server contact, gathers system data, and enables extensive data exfiltration. The malware’s stealthy operation ensures persistent data theft without user or system alerts.