CERT-AGID Exposes MintsLoader: PEC Turned into a Social…

CERT-AGID has identified a MintsLoader campaign that leverages compromised PEC mailboxes to send fake payment reminders. The attack was delivered on the evening of September 23, 2026, around 21:50, using ZIP archives containing HTML files that trigger a multi-stage infection chain. The technique exploits the trust users and businesses place in Certified Electronic Mail, a tool routinely used for legal and tax communications in Italy, to bypass the initial layer of suspicion.

{"main_topic":"malware","topics":["malware","phishing","cybersecurity"]}

CERT-AGID has identified a MintsLoader campaign that leverages compromised PEC mailboxes to send fake payment reminders. The attack was delivered on the evening of September 23, 2026, around 21:50, with ZIP archives containing HTML files that trigger a multi-stage infection chain. The technique exploits the trust users and businesses place in Certified Electronic Mail (PEC), a tool routinely used for legal and tax communications in Italy, to bypass the initial layer of suspicion.

Key Takeaways

CERT-AGID documented a MintsLoader campaign via PEC with fake payment reminders sent on the evening of September 23, 2026, around 21:50.
The infection chain proceeds from ZIP to HTML, then to JavaScript, PowerShell, MintsLoader, and finally RAT/Stealer malware.
Attackers use DGA algorithms to generate C2 domains and activate them with a delay: inactive at launch, operational on the morning of September 24.
PEC certification guarantees only transmission, not the security of the sender's mailbox nor the integrity of attachments.

The Technical Chain: From HTML to Loader

The CERT-AGID report traces every stage of the infection with textbook precision. The user receives a PEC message with a variable subject such as "Unpaid invoice – immediate response required." The attachment is a ZIP archive named to resemble an invoice, but instead of accounting documents it contains an HTML file. Opening this file causes the browser to contact the attackers' infrastructure, download JavaScript, and launch a PowerShell sequence that leads to MintsLoader execution.

MintsLoader is a loader, not the final payload: its job is to download and execute the ultimate malware, which CERT-AGID generically classifies as a RAT/Stealer. The distinction between downloader, loader, and payload has concrete operational implications: intercepting an intermediate stage does not automatically stop the entire chain if the C2 is still active and fallback domains are pre-generated.

"PEC → ZIP archive → HTML file → JavaScript → PowerShell → MintsLoader → final malware (RAT/Stealer)"

Social Engineering on the PEC Trust Boundary

The attack's strength lies in using PEC as a psychological lever, not a technical one. Certified Electronic Mail covers the transmission and delivery process: it guarantees the sending time, message integrity in transit, and sender identity at the moment of dispatch. It does not guarantee that the mailbox was not previously compromised, nor that the attached content is safe.

As CERT-AGID writes: "The presence of a PEC certifies the transmission and delivery process of the message, it does not guarantee that the sender's mailbox has not been compromised nor that the received attachment is safe." Users, accustomed to treating PEC as a reliable channel for tax notices, payment reminders, and legal notifications, have a structural incentive to open the attachment even without additional verification. The trust signal becomes the entry point.

The dossier does not specify how many mailboxes were compromised nor how the initial compromise occurred. It is unclear whether credentials were stolen, whether there was unauthorized access to a PEC provider's systems, or whether other vectors were employed. This gap has operational consequences: without knowing how the mailboxes fell into attackers' hands, it is impossible to assess the scope of the pool of potential malicious senders.

C2 Delay as an Evasion Technique

A recurring and distinctive element of the campaign is the delay in activating the command-and-control infrastructure. The domains generated via DGA were inactive when the PEC messages were sent on the evening of September 23. They became operational only on the morning of September 24, when recipients had likely already opened the attachment and security teams operate with reduced coverage.

CERT-AGID notes that "the same pattern had been observed by CERT-AGID in previous MintsLoader campaigns, where domains were activated during business hours after the malicious messages were sent." This is not novelty but pattern: the nighttime and weekend window, when SOCs have reduced staffing, is used to maximize the probability of execution before IoCs are distributed and added to blocklists. Timing is part of the weapon.

The use of DGA adds a further layer of resilience: even if a single domain is blacklisted, the malware can recompute or try alternatives without requiring manual infrastructure updates. The dossier does not specify the exact DGA family nor the seeds used, but the mention of the technique is explicit in the primary report.

Immediate Actions

CERT-AGID has shared indicators of compromise through the IoC Feed with accredited entities, including three SHA256 file hashes related to the campaign with a creation timestamp of September 24, 2026, at 10:40:05. Priority actions derive directly from the report:

Check for receipt of PEC messages with subjects resembling payment reminders sent on the evening of September 23, 2026, particularly those containing ZIP attachments, and report them to the SOC or information security manager.
Do not open ZIP attachments in PEC even from apparently legitimate senders without independent verification of the expected content, given that PEC certification does not extend its guarantee to attachment security.
Review network logs for connections to DGA-generated domains activated on the morning of September 24, 2026, in line with the IoCs published by CERT-AGID.
Request access to the CERT-AGID IoC Feed to receive automatic technical updates on the campaign, completing the accreditation procedure via the official form.

Why PEC as a Vector Changes the Game

The risk is not technical but systemic. In Italy, PEC is a mandatory channel for businesses, professionals, and public administration; it is integrated into electronic invoicing flows, tax notifications, and legal communications. When a compromised PEC mailbox sends malware, the damage is measured not only in infections but in erosion of trust in the infrastructure itself.

The CERT-AGID dossier does not quantify recipients nor the success rate, but the attack logic is clear: PEC is a trust domain that users are not trained to question. As long as this asymmetry persists, every mailbox compromise becomes a social engineering amplifier more powerful than traditional phishing email. The September 23 report documents a known pattern, not an isolated outbreak: the recurrence is a warning, not a comfort.

Information has been verified against cited sources and updated at the time of publication.

Sources

Sources and references

Get DeafLetter