Pharmaceuticals is a targeting label, not a malware family. APT38 used a job-offer pretext in spear-phishing against pharmaceutical companies in 2020, placing a decoy PDF and an application inside an ISO image. Because files extracted from an ISO did not inherit Mark-of-the-Web controls, the container could help malicious content execute with fewer trust warnings. The operators reportedly maintained the pretext with follow-up job postings.