Russian-language FileFix 'document access' lure — server address and look-alike hostnames

A Russian-language fake reCAPTCHA titled 'Подтверждение доступа' (access confirmation) copies an encoded PowerShell command and tells the visitor to press Win+E, Ctrl+L, Ctrl+V and Enter, which runs it from the File Explorer address bar. The command downloads run.ps1, which mounts nomad.iso and starts test_ndfl.lnk; the shortcut opens a genuine tax-office PDF as a decoy and runs List_ndfl_2026.pdf.exe, which sends the user name and computer name to a public request-collection service. One server hosts it under hostnames that imitate internal services of Russian banks, insurers and other companies (vpn., buh., cisco., dms., login., mx1.prod.), adding one company at a time since June 2026, e.g. buh.reallstbank[.]ru, cisco.parivpn[.]ru, mx1.prod.rossko[.]su, alfastrahv[.]ru, dms.cabinet-ingos[.]ru. Reported publicly by @Malwarehunterr on 2026-10-02.