AhnLab reported CHM malware attributed to RedEyes, also known as APT37 or ScarCruft, distributed to South Korean users through lures impersonating a domestic financial company's secure email. When opened, the CHM file displayed a fake help window while an embedded malicious script ran in the background. The script used a shortcut object to launch mshta, fetched a JavaScript file from attacker infrastructure, and executed encoded PowerShell commands, reusing a persistence command pattern previously observed in RedEyes M2RAT activity.