Damaged-order 'unboxing video' lure: share.google link to a /download.php/..._mp4 file host serving a signed WPS Office side-load

Malware delivery aimed at businesses that sell online. The email poses as a customer whose order arrived damaged and asks the recipient to review an 'unboxing video' or 'damage report'. It is sent through a legitimate no-code app platform, so it passes sender authentication, and its link is a share.google short link (once goo[.]su) that redirects to a file host such as get[.]passionit[.]co[.]nz, conntent[.]s4solar[.]co[.]nz, storage[.]westtec[.]co[.]nz or content[.]ambienti[.]co[.]nz. Every host serves the file from the same path, /download.php/<Lure_Name>_mp4?f=<token>, with lure names in English, French and Italian (Condition_Assessment_Report_mp4, Video_Du_Colis_Recu_Endommage_mp4, Verifica_Documentazione_Aziendale_2026). The hosts are old New Zealand business domains that lapsed and were re-registered, and newly registered look-alikes of them, all behind Cloudflare. The download is a ZIP of about 140 MB: a genuine, signed WPS Office program renamed to look like a video, which loads a hidden DLL of about 120 MB (krpt.dll) from the same folder, and a hidden folder of junk decoy files. The DLL is rebuilt between downloads, so its hash changes. Visitors on other systems get a 'Windows only' page. Seen since 2026-08-27.