Filedot.to Merc Link

Basic users can acquire shared directories without mandatory premium configurations. Contextualizing the "Merc" Asset

Upon execution, the file drops a legitimate-looking decoy document (e.g., a fake PDF) to distract the user while the MERC crypter unpacks in memory. filedot.to merc

In Q3 2024, a mid-sized logistics company suffered a breach. The initial access was traced to a sales employee who clicked a filedot.to link in a Discord message claiming to be "merc_invoice_#2309.pdf.exe." The MERC crypter deployed a RedLine stealer, which exfiltrated saved browser passwords for the company's AWS console. Within 48 hours, the attackers deployed LockBit ransomware via those stolen credentials. Basic users can acquire shared directories without mandatory