Proofpoint uncovered Cruciferra, a crypter-as-a-service that helps hackers evade antivirus and deliver malware in multiple campaigns.

Proofpoint’s research team traced a wave of income-tax-themed lures targeting Indian taxpayers, tax professionals, and corporate finance teams back to a crypter service called Cruciferra, and the tool turns out to be shared infrastructure used across multiple unrelated criminal groups.

A crypter’s job is simple to describe and hard to build well: scramble a malicious payload so antivirus tools can’t detect it, then unwrap it at just the right moment on the victim’s machine. Cruciferra does that job with a level of polish researchers don’t see often. It’s written in Mono and packs in indirect system calls, API unhooking, and a custom flavor of Process Ghosting designed to leave almost nothing behind for a forensic investigator to find.

“Cruciferra is written in Mono and features numerous techniques designed to evade detection, analysis, and incident response efforts. These include using indirect system calls, API and Import Address Table (IAT) unhooking, Bring-Your-Own-Vulnerable-Driver (BYOVD)-based EDR tampering, privilege escalation, persistence mechanisms, and a customized implementation of Process Ghosting used to execute payloads while minimizing forensic artifacts.” reads the report. “The crypter also includes a notable emphasis on payload protection. Cruciferra supports a large collection of custom encryption routines, many of which appear to be dynamically assembled from components of established cryptographic algorithms. This approach creates significant variation between samples, complicating static analysis and signature-based defenses. “

The pricing alone tells you this is a serious commercial operation, not a hobbyist’s side project. Sellers have advertised it on underground forums since fall 2025 for between $450 and $2,000 a month, marketed bluntly as one of the most effective crypters available. That price bought access to protection for a long list of commodity malware, including Agent Tesla, AsyncRAT, Remcos RAT, Snake Keylogger, XWorm, and several others.

What makes Cruciferra genuinely hard to fingerprint is that it doesn’t use one fixed encryption method. Each batch of samples gets its own encryption routine, built by mixing and matching pieces from well-known hashing, random number generation, and cipher algorithms, which means two Cruciferra samples can look completely unrelated at the code level. Researchers suspect this variation gets generated automatically rather than handpicked by a human, since the sheer number of combinations would be tedious to produce by hand.

One campaign traced to Cruciferra belongs to TA4922, a Chinese-speaking group with some overlap with another well-known operation called Silver Fox. TA4922 sent victims to fake landing pages hosting ZIP files disguised as tax documents, with four separate waves identified between April and early June 2026.

Cruciferra shows up in other unrelated campaigns too, which is really the point. One wave impersonated the US Social Security Administration to deliver XWorm and AdaptixC2 back in May, while another used complaints about bed bugs to target hotels and travel companies with zgRAT malware in late June. Different lures, different final payloads, same wrapper doing the hiding.

“Tax and government-related themes are frequent favorites of cybercriminals, and the U.S. Social Security Administration (SSA) is often abused in malware campaigns, including from actors using Cruciferra.” continues the report. “For example, in May, Proofpoint researchers observed emails impersonating the SSA regarding tax documents. (Curiously, the emails referred to items that needed to be completed by January 2026; it’s possible the actor repurposed an old lure, or mistakenly included the wrong date.)”

However it gets deployed, Cruciferra always loads through DLL side-loading and leans on the same set of evasion tricks. It hides its console window, strips visibility from Windows API calls, and abuses a vulnerable driver called GoFlyDrv.sys to kill off security processes running on the machine, a technique known in the industry as bring-your-own-vulnerable-driver. If it isn’t already running with administrator rights, it quietly bypasses Windows’ UAC prompt using a known COM elevation trick, then plants itself in the registry’s Run key under the unassuming name “putty” so it survives a reboot.

The final payload never actually touches disk as a real file. Cruciferra uses a variant of Process Ghosting, running code from a temporary file that gets deleted before the process even starts, which leaves security software with nothing to scan because there’s technically no file there.

“Process Ghosting is when malware creates a temporary file, marks it for pending deletion via NtSetInformationFile, writes the malicious payload into it, then creates an image section (NtCreateSection with SEC_IMAGE) from that file. Once the file handle is closed, the operating system deletes the file from disk while the section persists in memory.” states the report.”A legitimate process is then created in a suspended state, the ghost section is mapped into it via NtMapViewOfSection, the thread context is redirected to the payload’s entry point, and the thread is resumed. The result is a running process backed by a PE image that never existed on disk in a scannable state.”

On top of that, it patches memory-query hooks and tries to interfere with a Windows routine that manages hot patches, covering its own tracks and disabling integrity checks along the way.

None of the individual tricks here are brand new on their own. What stands out is how many of them Cruciferra stacks together in one modular package, built to protect whatever malware a customer wants to hide that week. Calling something “the most lethal crypter” in a forum ad is usually just sales talk, but this is one of the rare cases where the product notes actually undersell it.

“While crypters have long been used to evade detection and increase malware delivery and execution success rates, Cruciferra distinguishes itself through its extensive and unique defense-evasion capabilities, modular design, and highly customized and varied approach to payload protection.” concludes the report. “During our investigations, we observed Cruciferra delivering numerous malware families, including various remote access trojans and infostealers, highlighting its role as an enabling technology within the cybercrime ecosystem. Proofpoint will continue to monitor the development and adoption of Cruciferra and provide updates as new capabilities and campaigns are identified. “

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cruciferra)

RedWing: The Android Banking Trojan You Can Rent on Telegram for Less Than a Coffee Subscription

Zimperium’s zLabs team has uncovered RedWing, an Android spyware operation sold as a subscription service through Telegram, with links to Russian threat actors and apparent roots in the Oblivion malware family.

It comes with documentation, tutorial videos, a referral discount program, and a bot that builds custom malicious apps on demand. No malware-writing skill required.

“Far from being just another basic piece of malware sold online, RedWing is a fully developed, commercial-grade MaaS product with seller documentation, videos, and a bot-driven subscription model that provides a low entry barrier for novice attackers.” reads the report published by Zimperium. “As a proof of this, the APK customization/obfuscation/creation can be fully implemented through telegram.”

Infection starts with a phishing link that opens a fake app store page. The dropper builder can mimic Google Play, the Samsung Galaxy Store, or Huawei’s AppGallery with fake ratings, reviews, and download counts.

“the C2 panel features a sophisticated ‘Onboarding Constructor‘. Within the ‘Stealer’ configuration module, operators can deploy a deceptive ‘WebView + Cards’ interface. This mechanism loads a benign-looking webpage in the background to establish legitimacy, while sequentially overlaying customized permission prompts (cards) from the bottom of the screen.” continues the report. “Through tailored social engineering lures, the malware coerces the user into granting critical system access, specifically targeting three core permissions: disabling Battery Optimization (to ensure uninterrupted background execution), setting the application as the Default SMS handler (crucial for intercepting 2FA codes), and access to Notifications.”

Once installed, the app walks the victim through permission screens one at a time, disable battery optimization, set the app as the default SMS handler, enable notifications, framed as routine setup steps.

With those permissions in place, RedWing has deep system access. It deploys fake login screens over real banking and crypto apps to steal credentials, reads incoming texts to capture one-time codes, and uses Android’s Accessibility Service to lift PINs, card numbers, and CVV values directly off the screen as they appear.

The malicious code also silently enables call forwarding using a hidden carrier code, 21, redirecting all incoming calls to an attacker-controlled number, which knocks out phone-based two-factor authentication and bank fraud-prevention calls in one move.

The researchers pointed out that the surveillance capabilities go further. RedWing can remotely activate a victim’s camera and microphone, recording audio through commands sent from the attacker’s server with configurable recording duration.

“The malware is capable of remotely activating the cameras and the microphone of an infected device (Fig. 12). This functionality is executed via specific commands. For instance, the <take_photo> command allows the attacker to remotely capture images using the device’s camera. Similarly, the <start_recording> command leverages the MediaRecorder API to capture ambient audio.” continues the report. “This audio recording process is managed entirely from the remote server, which allows the attacker to configure the exact duration of the recording, among other parameters.”

On top of that, operators get live screen streaming via VNC, a real-time keylogger, access to all files on the device, contact lists, call logs, and location tracking.

The targeting architecture reveals something telling about how RedWing is built. The apps it monitors through Accessibility are baked into each compiled copy, which points to a fresh APK being generated server-side each time a buyer specifies their targets. The overlay targets, by contrast, can be updated from the control panel at any time without distributing a new app.

Zimperium identified 82 targeted institutions across multiple sectors, with a heavy focus on Russian financial firms, one sample used a fake RuStore page, though the list can shift at any time from the operator’s dashboard.

RedWing doesn’t need any Android vulnerability to work. It relies entirely on the user installing an app from outside an official store and approving its permission requests. The first line of defense is what happens at install time: don’t install apps from links sent by text or messaging apps, don’t grant Accessibility or default-SMS access to apps with no clear reason to need them, and treat any app that hides its icon after installation as a red flag. On managed devices, sideloading can be blocked centrally and suspicious permission requests flagged automatically.

RedWing can also transform infected Android devices into a botnet capable of launching coordinated DDoS attacks. Through its control panel, attackers can command multiple compromised phones at once to send traffic floods against a target website or server, disrupting its availability and adding another capability beyond spying and data theft.

Because operators can reskin the app and swap its targets from the control panel, the app name is a poor indicator, behavior is what to watch for.

“The rapid rise of Malware-as-a-Service (MaaS) operations like RedWing shows how easily attackers can weaponize legitimate Android components to achieve full device compromise. Unlike older banking trojans that rely solely on overlays, RedWing integrates custom droppers, live screen streaming, and abuse of the SMS handler role and Accessibility to exfiltrate data and impersonate legitimate apps in real time.” concludes the report. “This blend of social engineering and hijacking the incoming calls makes this deep-system control especially dangerous in BYOD and consumer-facing environments where app-store trust is assumed.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Malware)