Darktrace (Oct 14) describes a campaign using a disk image (Proposition_Projet.img) with a decoy French PDF and an LNK posing as a .docx. Hidden PowerShell XOR-decodes a Nim loader into %TEMP%\IfyuUapz.txt, which plants a Rust DLL as C:\Program Files (x86)\Microsoft\Edge\Application\dbghelp.dll via a computerdefaults.exe UAC bypass. Hunt for: writes to HKCU\Software\Classes\ms-settings\shell\open\command; C:\Windows\Temp\dbghelp.tmp; any non-Microsoft-signed dbghelp.dll in the Edge directory; LNK files spawning hidden PowerShell that reads a PDF as bytes; non-browser processes talking to Discord API/gateway, ipify.org lookups, and ngrok tunnels. MD5s: LNK 62e3e85eca78a0cd7e6669e9f33d936d, dbghelp.dll c66858718d883bcfb9ce2c19b59f96c9, loader 2deb724a709b0b892248405323350e9b, PDF eeb52cb95113a131c2c7713c17872da6.