ZipLine Works by Letting the Victim Make the First Move
Traditional phishing begins with unsolicited emails sent en masse. ZipLine takes the opposite approach. Attackers first initiate contact through an organization’s public “Contact Us” form, tricking employees into thinking they are engaging with a legitimate business inquiry. This approach poses a significant risk to state and local agencies that have public-facing online forms — which means most of them.
This simple but clever tactic forces the victim to make the first move, sending their initial email back to the attacker. From that moment on, the conversation appears more authentic and bypasses reputation-based security filters designed to catch suspicious inbound emails.
RELATED: AI is the new cybersecurity frontline for utilities.
Professional Conversations, Staged Over Weeks
Unlike typical one-and-done phishing attempts, ZipLine attackers play the long game. They invest days or even weeks in building credibility through professional email exchanges. In some cases, they use the NDA signing step as the ultimate lure, after weeks of conversation.
That final step is where the trap is sprung: The attacker delivers a malicious ZIP file containing both benign documents such as the NDA and a weaponized shortcut file. When clicked, it unleashes custom malware that uses DNS tunneling and HTTP fallback to maintain stealthy, persistent control of infected systems.
Riding the AI Wave
ZipLine doesn’t stop there. In a second wave of attacks, researchers observed phishing lures disguised as internal “AI Impact Assessments.” Framed as questionnaires on how artificial intelligence could improve efficiency and reduce costs, these messages tap into business buzz to increase credibility. While researchers did not recover malware from the AI-themed samples analyzed, the attackers’ infrastructure reuse suggests the same staged ZIP delivery model was likely in play.
This blending of social engineering with current technology narratives highlights the attackers’ growing sophistication. They are watching the same headlines we are — and adapting their lures accordingly.
Supply Chains Are in the Crosshairs
ZipLine has primarily targeted companies critical to the U.S. manufacturing and supply chain ecosystem, both of which directly influence the nation’s critical infrastructure. The consequences of compromise in this sector are serious:
- Intellectual property theft and ransomware attacks could halt production and erode competitiveness.
- Financial fraud through stolen credentials, account takeovers or business email compromise could cause major losses.
- Supply chain disruptions could ripple across industries, delaying delivery of essential components and impacting national resilience.
In short, campaigns such as ZipLine threaten not just individual companies but the broader economy, critical infrastructure and national security.
SUBSCRIBE: Sign up for the StateTech newsletter for weekly updates.
