Invoice Lures, Shortcut Chains, and RAT Swapouts: The New Shape of Phishing Delivery

A fake invoice PDF, layered shortcuts, and public tunnel infrastructure form a compact delivery chain that can swap between multiple remote access trojans without changing the user-facing lure.