Common signs include password protected archives, country-based redirects, login-gated script links, and content that changes based on source IP or browser context. If the same lure leads to a benign decoy for some users but a download for others, the campaign is likely using selective delivery. Those behaviors should trigger deeper inspection and network telemetry review.
How selective delivery helps malicious archive and script campaigns evade analysis
Selective delivery is a control-evasion pattern, not just an obfuscation trick. Attackers use it to make the same lure behave differently depending on who opens it, which network it comes from, or what browser context is present. That splits the campaign into a harmless-looking path for scanners and a malicious path for real targets, which reduces automated detection and makes sample collection less reliable.
It matters because many sandboxes, crawlers, and link scanners present a predictable footprint. If the campaign can recognize that footprint, it can suppress the payload, serve a decoy, or refuse to complete the chain, leaving analysts with an incomplete picture of the actual delivery path.
Common delivery controls include password protected archives, region-aware redirects, gated download pages, and content that only appears after a browser or referrer check. Each one adds a friction point for automated tools, but together they also create a stronger signal for defenders that the artifact is trying to hide its real behavior.
What the campaign is trying to hide from automated analysis
The goal is usually to separate discovery from detonation. A benign-looking archive may only reveal the real script after a password is entered, or a script link may only resolve for selected geographies, referrers, or user agents. In other cases, the lure is conditionally served so that a scanner receives a harmless file while a human target receives the executable payload.
This matters because automated analysis often assumes that one retrieved artifact represents the whole campaign. Selective delivery breaks that assumption. It can hide downloader stages, suppress secondary payloads, and make the observed chain look shorter or cleaner than it actually is.
For defenders, the key point is that the campaign is not merely “using redirects.” It is testing whether the request looks like an analyst, a bot, or a target, then changing the response to preserve the malicious path for the latter.
What to inspect when the lure behaves inconsistently
Inconsistent behavior is the strongest clue. If the same link yields different content across IP ranges, browsers, or repeated requests, treat that as evidence of conditional delivery rather than a broken download. Archive wrappers that require a password, scripts that only load through a login gate, and pages that swap content after a redirect sequence should all be preserved for further inspection.
- Compare responses from different networks and user agents.
- Check whether the file hash or payload changes across attempts.
- Inspect redirect chains, referrer checks, and landing-page logic.
- Correlate web telemetry with DNS, proxy, and endpoint events to see which branch was actually reached.
That workflow matters because the evasion may live in the delivery logic, not in the final payload alone. If you only analyze the visible sample once, you may miss the branch that delivers the real script or archive.
Risk and Threat Considerations
Selective delivery increases the chance that scanners, mail gateways, and analysts will clear a malicious artifact that would never be shown to the intended target. It also delays triage because defenders may see only a decoy, while the true payload remains hidden behind environment checks or gated access.
Failure mechanism: The campaign uses request-dependent logic, such as IP reputation, browser fingerprinting, passwords, or login state, to suppress malicious content until a qualifying target is observed. Automated systems that do not reproduce those conditions receive an incomplete or harmless result.
Impact: Detection coverage drops, sample attribution becomes less reliable, and downstream response work can focus on the wrong artifact. In a coordinated campaign, that gap can let malicious archives or scripts persist longer before the real delivery path is identified.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1105 — Ingress Tool Transfer | Selective delivery often hides the real payload transfer path. |
| T1036 — Masquerading | Decoy content and environment-based swapping disguise malicious delivery. | |
| T1102 — Web Service | Redirectors and gated links commonly route victims through web-based access paths. | |
| Recommendation — Map observed download branches to T1105 and inspect the delivery chain for hidden payload stages. Correlate decoy behavior with T1036 and hunt for content that changes under analysis conditions. Trace web redirects under T1102 to identify where the malicious branch diverges. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Telemetry review is needed to reconstruct conditional delivery behavior. |
| CIS-13 — Network Monitoring and Defense | Network telemetry reveals region, referrer, and IP-based evasion patterns. | |
| Recommendation — Centralize and review web, DNS, and endpoint logs to compare delivery branches. Use network monitoring to spot request patterns that trigger alternate or benign responses. | ||
Practitioner Guidance
What to verify: Confirm whether the apparent decoy is the only artifact you have, or just one branch of a conditional delivery flow. If the lure changes by source IP, referrer, or browser context, treat the branch logic as part of the threat and not as incidental website behavior.
What to prioritize: Preserve the original network path and response metadata before detonating or unpacking anything. The most useful evidence is often the redirect sequence, access control behavior, and telemetry around who received which version of the content.
Practitioner takeaway: When a campaign behaves differently for scanners and humans, the evasion logic is often more important than the visible payload, because that logic determines what your tools are actually able to see.
Related resources from NHI Mgmt Group
- What are the signs that a malicious package campaign is trying to evade detection through naming patterns?
- What are the signs that a phishing kit is trying to evade automated security analysis?
- What are the signs that a JavaScript skimmer is trying to evade analysis or debugging?
- What are the signs that a malware campaign is using virtualization checks to evade analysis?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
