SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

What happened

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with spear-phishing (messages that impersonate someone to obtain passwords or money) attacks that deploy ReverseRAT on Windows systems. The October 15, 2026, advisory classifies the threat as medium severity and highlights malware that can steal passwords, capture screenshots, and collect sensitive information.

The intrusion begins with a phishing email carrying a weaponized ZIP archive.

The campaign combines deceptive attachments, malicious Windows shortcuts, obfuscated scripts, and legitimate operating system utilities. SideCopy Hackers Target Indian Organizations Trellix researchers documented a multistage infection chain that establishes persistence before loading the remote access Trojan into memory, complicating detection through conventional file scanning.