A StreamRat banking trojan campaign uses fake Meta TV-streaming ads to infect Android users. The StreamRat banking trojan enables full device takeover.
Related Posts:
The post StreamRat Banking Trojan Targets Spanish Android Users appeared first on Daily CyberSecurity.
Silver Fox fake software installers impersonate Razer and Edge to disable Windows Defender and deploy malware. See how the campaign works.
Related Posts:
The post Silver Fox Fake Software Installers Disable Windows Defender appeared first on Daily CyberSecurity.
Proofpoint found the PackClient RAT sold on Telegram and used by Chinese-speaking TA4922 malware operators in tax-themed phishing attacks.
Related Posts:
The post PackClient RAT: New C2 Framework Sold on Telegram appeared first on Daily CyberSecurity.
A Cambodia malware campaign hides SparkRAT in PNG files and abuses a vulnerable driver to kill antivirus, Acronis TRU reports.
Related Posts:
The post Cambodia Malware Campaign Uses PNG Files to Deliver SparkRAT appeared first on Daily CyberSecurity.
ValleyRAT doesn’t always need to disguise itself as a cracked game or a fake browser update. It can also hide behind something much more ordinary: an application that looks like adware and appears to serve a legitimate purpose.
Kaspersky’s latest analysis shows how this works. Researchers found a malicious installer that uses a modified version of QN Wallpaper, a legitimate Chinese desktop wallpaper application, to deliver the ValleyRAT backdoor while making the infection look like a normal software installation.
Researchers found a malicious installer that uses a modified version of QN Wallpaper, a legitimate Chinese desktop wallpaper application, to deliver the ValleyRAT backdoor while making the infection look like a normal software installation.
The interesting part is how the attackers make the first stages look harmless. The installer can present itself as software associated with DingTalk, Google Chrome or Tencent Meeting, depending on the filename, while quietly deploying the modified wallpaper application in the background.
That gives the victim something familiar to look at while the real work happens elsewhere. It’s a simple trick, but it removes one of the most obvious warning signs of a malware infection: the feeling that something unusual has just been installed.
Kaspersky originally received one of the samples because a customer wanted it classified as adware. An initial look at the file suggested exactly that, but suspicious network activity changed the picture and led researchers to examine the sample more closely. They found that the advertising component didn’t actually perform its supposed job. Instead, it started an infection chain that eventually loaded ValleyRAT.
“The original version of QN Wallpaper is genuine adware: on installation, it delivers bundled partner apps to the device and then displays ad banners to the user.” reads Kaspersky’s report. “In this case, however, the attackers use it to carry out DLL sideloading, a technique that allows malicious code to run under the guise of a signed process by way of a malicious DLL.”
That distinction matters because the attackers aren’t inventing a fake application from scratch. They’re abusing software that already looks legitimate and using its normal execution flow to load malicious code.
The technique is DLL sideloading. In simple terms, the attacker places a malicious DLL where a legitimate program expects to find a library, allowing the trusted application to load the attacker’s code.
Here, the relevant library is libcef.dll. QN Wallpaper and its companion process load that library when they start, giving the attackers a convenient place to execute their own code under the name of a legitimate application.
The installer also creates persistence and disables Windows Defender through the DisableAntiSpyware registry key before launching QnWallpaper.exe. That combination makes the infection considerably more serious than ordinary adware.
Once the malicious library runs, it checks whether the current user has administrator privileges. If necessary, it attempts to relaunch the process with elevated privileges before continuing with the next stage.
The actual ValleyRAT payload sits encrypted inside the infection chain. Depending on which legitimate process loads the malicious library, the backdoor comes from either a separate PeLoader file or resources embedded in libcef.dll.
The payloads use AES encryption and contain ValleyRAT as an encrypted DLL. Their configurations differ mainly in the command-and-control addresses they use, giving the operators more than one way to manage infected systems.
ValleyRAT then starts behaving like the backdoor it actually is. It reads its configuration, connects to its command-and-control infrastructure and prepares a range of functions that give an attacker control over the compromised machine.
The malware can collect keystrokes and clipboard contents, monitor the active window and gather detailed information about the infected system. That includes the hostname, IP addresses, Windows version, CPU information, available disk space, graphics adapter, language settings and other system details.
“The backdoor also has spyware functionality. While running, it tracks keystrokes and the currently focused window by using functions from the DirectInput8 library. It also captures clipboard contents.” continues the report. “All collected data is saved to a file on disk.”
The operator can also order the backdoor to take screenshots, reboot or shut down the machine, wipe logs, change its command-and-control addresses and download additional modules. ValleyRAT can retrieve those modules from either its own C2 infrastructure or a third-party address.
That last capability gives the attackers room to change what the malware does after the initial infection. They don’t need to put every capability into the first payload if they can download new components later.
The malware also takes steps to make itself harder to remove. Depending on its configuration, it can inject code into svchost.exe so that the backdoor restarts if someone stops it. It can also mark its own process as critical, meaning that terminating it can trigger a system crash.
That’s not subtle, but it’s effective. The malware is essentially telling the defender that killing the process isn’t supposed to be a clean operation.
Kaspersky says ValleyRAT can detect security and traffic-analysis tools, while the campaign has been detected over 100,000 times in 2026, affecting more than 1,500 users, mainly in China and India. The activity is linked to Silver Fox, focused on both espionage and financial gain.
In July 2026, Cato CTRL documented a SilverFox campaign targeting a Japanese industrial manufacturer. The attack chain adds two previously undocumented DLL-sideloading hosts, two kernel drivers not previously associated with SilverFox, and a dual-layer recovery architecture that keeps ValleyRAT running even if defenders terminate individual components.
That broader activity puts the Kaspersky finding into perspective. The adware campaign isn’t an isolated curiosity. It fits a larger pattern in which Silver Fox uses legitimate software, familiar brands and trusted execution paths to get malicious code onto Windows systems and keep it there.
For defenders, blocking a known ValleyRAT file is not enough because the real risk is how the malware gets executed. A legitimate-looking application, signed component or familiar installer can become part of a malicious chain. Antivirus exclusions can make the problem worse by creating blind spots.
“This case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear. ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules.” concludes the report. “The attackers exploited a well-known adware application to run the backdoor under the guise of a signed process, which complicates detection.”
Kaspersky recommends clear rules for third-party software, security awareness and avoiding suspicious applications or exclusions simply because a program asks for them. The malware does not need to look dangerous; it only needs to look legitimate enough that nobody questions why an ordinary application suddenly behaves like a backdoor.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Kaspersky uncovered a ValleyRAT backdoor adware campaign using signed wallpaper apps to drop malware. Learn how to protect your systems.
Related Posts:
The post ValleyRAT Backdoor Spread via Signed Chinese Adware appeared first on Daily CyberSecurity.
SilkParasite APT ran China-nexus cyberespionage across Central Asia, using 7 custom RATs, DLL sideloading, and AI-assisted malware.
Related Posts:
The post SilkParasite APT Hits Central Asian Governments With 7 RATs appeared first on Daily CyberSecurity.
Cato CTRL documented a new SilverFox campaign targeting a Japanese industrial manufacturer. The attack chain adds two previously undocumented DLL-sideloading hosts, two kernel drivers not previously associated with SilverFox, and a dual-layer recovery architecture that keeps ValleyRAT running even if defenders terminate individual components.
The attack chain starts with an invoice-themed phishing email. The last stage was remote access via ValleyRAT. Everything in between is the interesting part.
“The attack begins with an invoice-themed phishing lure and uses attacker-controlled content hosted through legitimate QQ and Tencent Cloud services. The attackers then abuse ConvertToPDF.exe and PDFDirect.exe to sideload a malicious PDFCORE8.dll.” reads the report published by Cato. “Based on the public research we reviewed, neither application had previously been documented as a DLL-sideloading host.”
Both applications are legitimate products from Zeon Corporation, digitally signed and unmodified. The attack works because Windows resolves DLL dependencies from the local working directory first, so placing a malicious PDFCORE8.dll in the same folder as the trusted executable is enough.
In some samples, the executable was also renamed MicrosoftEdgeUpdate.exe to reduce suspicion further, which at least shows a sense of humor about impersonation targets.
Once loaded, PDFCORE8.dll operates as a self-contained execution framework with all its most dangerous components stored inside as encrypted resources.
“The malicious PDFCORE8.dll embeds BootRepair.sys, EnPortv.sys, and wsftprm.sys and manages them through shared resource-decryption, driver-deployment, service-creation, and device-communication routines.” continues the report. “One of the most significant findings in this campaign is SilverFox’s modular BYOVD framework. Rather than depending on a single signed but vulnerable driver, the malware supports three options: BootRepair.sys, EnPortv.sys, and wsftprm.sys.“
Across variants, the malware mainly changes the driver image, device name, and IOCTL value while reusing the same core framework.
The practical implication of this modular design is that blocking one driver doesn’t stop the attack, the framework simply tries another. BootRepair.sys and EnPortv.sys are both new associations for SilverFox; wsftprm.sys appeared in prior reporting on the group.
All three drivers ultimately serve the same purpose: getting a process identifier into kernel space and calling ZwTerminateProcess() on security products that user-mode processes can’t touch. The user-mode component enumerates running processes, matches them against a hardcoded list of endpoint security tools, and passes the PIDs to whichever driver is loaded. The driver handles the actual kill from kernel mode. The malware also unhooks NTDLL by replacing its in-memory .text section with a clean copy from disk, removing inline monitoring hooks before calling native Windows APIs.
After terminating security processes and cleaning up API hooks, the malware contacts its C2 at 43.128.26[.]132, downloads shellcode, injects it into a suspended svchost.exe process via thread-context hijacking, and stores both the shellcode and its configuration in the registry, under HKCU\Console\0 and HKLM\SOFTWARE\IpDates_sun respectively.
“Before executing the registry-resident shellcode, the malware searches it for the marker: FaCai2024 The marker does not represent executable instructions. Instead, it identifies a reserved region inside the payload where the malware inserts its runtime configuration.” continues the report. “The framework retrieves the configuration from: HKLM\SOFTWARE\IpDates_sun It then replaces the FaCai2024 placeholder with the recovered C2 information, producing a fully configured payload immediately before execution. This separation gives the attacker operational flexibility. The same stored payload can be reused with updated server addresses or ports without changing the payload body itself.”
“Fa Cai” means “become prosperous” in Mandarin. Tencent Security previously documented the same marker and registry location in earlier FaCai phishing group activity.
The recovery architecture is what makes this campaign notably harder to disrupt than typical malware deployments. An internal monitoring routine checks every cycle whether the injected svchost.exe process is still active, and recreates the payload if it isn’t. An external watchdog, a batch script embedded in the DLL’s resources and executed via cmd.exe, checks every 30 seconds whether the loader itself is still running, and relaunches it if not. Defenders who terminate only the injected payload leave the loader running to recreate it.
Defenders who terminate only the loader leave the watchdog running to restart it. Both components need to go simultaneously, and then the scheduled task that relaunches the loader on logon needs to go too.
Detection should focus on behavior sequences rather than individual indicators. ConvertToPDF.exe or PDFDirect.exe executing from %TEMP%, kernel-driver services for any of the three embedded drivers appearing, binary data written to HKCU\Console\0, and tasklist.exe or find.exe running repeatedly from cmd.exe are each individually explainable — together they describe this specific attack chain. Cato’s NGAM blocked the malicious PDFCORE8.dll before the driver deployment stage was reached in the observed incident, which cut the chain at its most central point since the DLL contains every subsequent capability the attack depends on.
“This campaign shows how SilverFox is expanding its defense-evasion and remote-access toolkit. The most significant additions are the previously undocumented SilverFox use of BootRepair.sys and EnPortv.sys, along with the abuse of ConvertToPDF.exe and PDFDirect.exe as DLL-sideloading hosts.” concluders the report. “The malicious PDFCORE8.dll brings these capabilities together in one modular stage that combines vulnerable-driver deployment, security-process termination, NTDLL unhooking, thread-context hijacking, registry-based payload storage, and dual recovery mechanisms. This design improves resilience by allowing the malware to restore execution if either the payload or loader is interrupted.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SilverFox APT)
Hunt.io researchers and independent journalist NetAskari started with a fraudulent Android app impersonating a Chinese Provincial Public Security Bureau service and ended up mapping a sprawling criminal ecosystem built around a leaked Android RAT framework called Flying Eagle, 飞鹰. The investigation found 170 active servers, two Telegram channels distributing modified versions of the stolen codebase, and a likely successor platform already in version 2 development. Chinese state media had already warned citizens about the fake police app in June 2026. Nobody had yet traced what was behind it.
“Analysis of the malware led to a Telegram channel distributing the source code for an undocumented Android application builder and device control framework called Flying Eagle (飞鹰). Hunt.io researchers pivoted on TLS certificates and panel fingerprints to identify 170 servers running the framework, and uncovered a fractured criminal ecosystem built around its leaked codebase.” reads the report published by Hunt.io. “Flying Eagle combines APK generation and full-featured C2 device management in a single panel, with phishing overlays for financial, adult, and government service apps. The source code was stolen in early 2026, along with nearly 200 customer databases, leading to multiple modified variants circulating across criminal actors”
The leak turned a single commercial RAT into an open toolkit that anyone willing to pay 2,000 USDT for a “fixed” version, or nothing at all for the free Docker release dropped on Telegram in April, could deploy.
The framework is more capable than most MaaS offerings at this price point.
“The APK generation module accepts user-defined lured text, application names, icons, and C2 callback addresses, then builds a signed APK using one of two base templates.” continues the report. “Additional observed templates: Chinese adult streaming services, TikTok, financial applications, and landing pages for public welfare projects that send the number of visits and downloads back to the operator.”
To evade antivirus detection, the builder pads APKs with fake JSON configuration data and encrypts C2 callback URLs using AES-128-CBC with hardcoded cryptographic parameters.
The original class names in the source code tell you exactly what the tool does: RecordPayPassword, LiveKeysStrok, ScreenCaps, Webjector, CameraCap. At build time all of those get replaced with randomized 8-to-14 character strings, so static analysis hits a wall immediately.
Hunt.io identified the broader infrastructure through two independent fingerprints: the AdminPro title that briefly appears before operator branding loads, combined with a consistent HTTP 302 redirect behavior and Strict-Transport-Security header. A separate query for servers still running the default TLS certificate packaged with the Flying Eagle Docker deployment added another 12 unique servers. The pivot that connected the Docker version to a separate Windows XAMPP deployment was a misspelled environment variable, SECRIT_KEY, present in both codebases. Someone left a typo in the source, and it followed every fork.
The two Telegram channels operating around Flying Eagle have different roles. Yx科技 functions as sales and operational support: its first messages were step-by-step instructions for draining Alipay and WeChat accounts, referring to victims as “fish” and offering cash-out services at 20 to 50 percent transaction fees.
The SQLRCE0 Telegram channel, created in February 2026, was among the first to distribute Flying Eagle-related files. Researchers found that its posts indicated a leak of the RAT’s source code, including a chat screenshot between an unidentified actor and the malware developers known as “Flying Eagle Tech.”
“The chat showed a negotiation over access to 189 Feiying server and exfiltrated database, with the unknown party claiming to have compromised customer infrastructure.” continues the report. “SQLRCE0 used the ensuing messages to make multiple fixes to the leaked source code: domain connectivity, WebSocket stability, anti-uninstall features, and more all while assuring users with a money back guarantee that all backdoors had been removed from the code.”
A money-back guarantee on a backdoor-free criminal RAT. The market for this stuff is apparently competitive enough to require customer service.
On June 23, three weeks after Chinese state media published the public safety notice, SQLRCE0 introduced Night Dragon, 夜龙,as an independently developed successor. It’s not a reskin of Flying Eagle: it’s a separate build, currently in version 2 development as of July 12. Night Dragon adds a black-screen mode that shows a fake system update to hide operator activity, automatic icon hiding after installation, and single-click credential capture overlays for Alipay, WeChat, ICBC, Construction Bank, Agricultural Bank, and cryptocurrency wallets TokenPocket and imToken.
Hunt.io found one exposed Night Dragon panel showing 46 devices online with 29 actively connected, all geolocated in China. Whether those are real victims or test data is unverified. The operator account names translate to variants of “get rich,” which at least makes the intent clear.
“The device control interface provides full remote access including live screen viewing, SMS and photo gallery access, audio recording, camera capture, and file management. A phishing overlay system allows operators to deploy credential capture prompts for specific applications, with single-click shortcuts for Alipay, WeChat, and major Chinese banks including ICBC, Construction Bank, and Agricultural Bank, in addition to cryptocurrency wallets TokenPocket and imToken.” concludes the report. “Night Dragon represents an evolution beyond the variants of Flying Eagle. Where Yx Technology and SQLRCE0 both distributed modified versions of an existing codebase, this project appears to be an independent build, which is currently in active version 2 development as of July 12th. Its emergence just three weeks after the public safety notice suggests the demand for Chinese-language Android RAT tooling continues to drive criminal actors even as existing platforms are exposed.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Flying Eagle)
Windows has always supported hidden desktops as a legitimate feature, useful for specialized software that needs a workspace the user never touches. It’s a niche capability most people never think about, buried deep in how the operating system manages sessions. Unfortunately, malware authors noticed that too, and BlackFog’s research team just dissected a new remote access trojan called MedusaHVNC that maliciously uses this feature.
“We recently came across a sample of MedusaHVNC, a new remote access trojan (RAT) being sold as malware-as-a-service (MaaS). When we took it apart, we found a hidden virtual network computing (HVNC) module that opens a browser on a separate Windows desktop, out of sight of the victim.” reads the report published by Blackfog. “The browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state. This gives the operator access to live, logged-in sessions while the activity continues to come from the victim’s usual machine.”
MedusaHVNC is marketed through its own website and Telegram channel as a malware-as-a-service platform. It includes in-memory execution of .NET and native payloads with AMSI and ETW bypasses, plus browser recovery features to steal passwords, cookies, and browsing history. It supports Chrome, Edge, Brave, Firefox, and Telegram, making credential and session theft easier.
The core feature is a hidden virtual network computing module that spins up a real browser on a separate desktop the victim never sees. BlackFog obtained a video showing an operator’s console with Google Chrome open on Google’s homepage, already signed into an account, alongside controls for adjusting frame rate and image quality like it’s a video call.
That level of polish tells you this wasn’t thrown together over a weekend. The client panel lets an operator pick which browser to run, Chrome, Edge, or Firefox, and configure the session before it even launches, turning account takeover into something closer to a point-and-click chore.
Getting there takes five stages, starting from something almost embarrassingly mundane. The chain kicks off when Windows Script Host runs an obfuscated JScript launcher, which pauses for exactly 7,584 milliseconds before rebuilding its files under a folder called Nx2981Okkr2 inside the Temp directory. That pause isn’t an accident; it’s the kind of small delay malware authors add to slip past sandboxes that only watch a sample for a few seconds. From there it drops an AutoIt interpreter, a config file, an encrypted payload with no file extension, and a batch script tucked into the Startup folder so the infection survives a reboot.
AutoIt, a completely legitimate Windows automation tool, then decrypts that payload using a single-byte XOR key, the value 0xAE, producing the first native 64-bit executable in the chain. That executable launches straight into charmap.exe, yes, the built-in Windows Character Map utility that ships on every machine. Sandbox data BlackFog reviewed shows charmap.exe spawning as a child of the AutoIt process, with the malicious loader injected directly into it, turning a completely trusted system binary into the payload’s hiding spot. Anyone scanning a process list for something suspicious would glance right past it, because nothing looks more boring than the character map tool.
Inside charmap.exe, the loader still isn’t done unwrapping itself. It runs a 16-byte repeating XOR pass across just over a million bytes of data, then a ChaCha20 decryption step using a 32-byte key and a 12-byte nonce, before the actual malware finally emerges. That’s three separate layers of obfuscation stacked on top of each other, each one designed to slow down anyone trying to reverse-engineer the sample by hand. BlackFog says it rebuilt that entire unpacking process offline and recovered the final payload byte for byte, which is about as thorough as forensic verification gets.
What comes out the other side is an unsigned 64-bit executable carrying the internal string MedusaHVNC. It talks to its operator over a custom protocol built on Windows’ native networking functions, and the command server address, 51.89.204.28 on port 4444, is baked directly into the binary rather than resolved dynamically. Fixed infrastructure like that is a tradeoff: simple for the attacker to run, but also a stable target defenders can block outright the moment they know to look for it.
Once the hidden session is live, the malware leans entirely on legitimate Windows capabilities to do its work. Screen and window capture ride on built-in functions like BitBlt, EnumWindows, and PrintWindow, while synthetic mouse clicks and keystrokes come through SendInput and SetWindowsHookExW. Clipboard functions round out the toolkit, giving the operator a simple way to move text and files into or out of the hidden session without ever touching a file transfer tool that might get flagged.
“Clipboard functions, including OpenClipboard, GetClipboardData, and SetClipboardData, provide another way to move information into or out of the session.” continues the report. “Taken together, these findings are consistent with the core HVNC workflow. The browser references identify the applications involved, and the capture, input, window-management, and clipboard functions provide the mechanisms needed to observe and control activity inside the hidden desktop.”
None of these are exotic hacking tools. They’re the same APIs legitimate remote-support software uses every day, which is exactly why watching process behavior alone won’t catch this. A security tool looking for “malicious” function calls will come up empty, because every single function involved has a completely ordinary, everyday use.
BlackFog’s own conclusion lands on the one place this scheme can’t hide: the network. Whatever happens inside that invisible browser, moving money, logging into accounts, copying data, still has to leave the machine to reach the operator, and that outbound connection looks the same whether it came from a hidden desktop or a plain remote-access tool. Blocking the known command server and the associated file hashes is a reasonable starting point for any team that wants to act today rather than wait for a signature update. It’s also exactly the layer BlackFog built its own anti-data-exfiltration product to watch, catching the connection in real time regardless of which process tries to make it, browser or otherwise.
Funny thing about building an invisible desktop: it’s only invisible until the data tries to leave the building, and buildings tend to have exits everyone’s watching.
“An unapproved connection to an attacker’s server is the same event whether it comes from a browser or a native client. Blocking traffic to known C2 infrastructure and alerting on unexpected outbound connections works regardless of how the session was hidden. Blocking the C2 address and the hashes in the IOC table is a concrete starting point.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, MedusaHVNC )
Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that routes its entire command-and-control channel through the victim’s own Chrome or Edge browser.
The malware process itself never makes a network connection. Everything it sends and receives goes through the browser via Chrome DevTools Protocol, the same debugging interface developers use to inspect web pages.
“msaRAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol CDP), a browser debugging API. The binary contains a Cloudflare Workers endpoint (“is-01-ast[.]ols-img-12[.]workers[.]dev”), but rather than making HTTP connections to this domain itself, it offloads that entirely to the browser.” reads the report published by Cisco Talos. “This endpoint is dedicated solely to signaling relay (SDP Offer/Answer exchange) for establishing a WebRTC connection; once the WebRTC connection is established, Cloudflare Workers drops out of the communication path entirely. All subsequent C2 commands are exchanged exclusively over the WebRTC DataChannel.”
What a network defender sees on the wire is a browser process making HTTPS requests to Cloudflare and WebRTC traffic to Twilio’s relay service, both legitimate, both commonly allowed. The attacker’s server address never appears in the traffic at all.
The infection starts unremarkably. After gaining access to a Windows machine, the attacker runs curl to download an MSI file named update_ms.msi from an attacker-controlled server on port 443, though the traffic runs over plain HTTP. Firewalls that filter by port number without inspecting the actual protocol let it through. The MSI impersonates a Windows update and loads the RAT DLL directly into memory via a custom installer action. From there, msaRAT looks for Chrome or Edge through environment variables in a defined priority order, then falls back to a registry lookup for Chrome if nothing is found. No browser means no C2 channel, the CDP manipulation simply doesn’t execute.
Once it finds a browser, msaRAT launches it in headless mode with remote debugging enabled, connects to it over the local debugging port, bypasses Content Security Policy using a CDP command, and injects JavaScript that handles all the actual network work.
“By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN.” Talos continues. “By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Workers makes it significantly difficult to trace the attacker’s infrastructure.”
Cloudflare Workers handles the SDP signaling to set up the WebRTC channel, then drops out of the picture entirely. All subsequent commands flow over the WebRTC DataChannel through Twilio’s relay.
The communication is double-encrypted. WebRTC DataChannel is already protected by DTLS, which the browser handles automatically. On top of that, msaRAT encrypts the payload itself using ChaCha-Poly1305 with a key derived through an ECDH handshake at connection time.
“Separately, msaRAT encrypts the data itself using a ChaCha-Poly1305-based encryption scheme before passing it to the browser, resulting in double-layer encryption. This design ensures that even if DTLS is stripped, an adversary-in-the-middle cannot read the contents.” reads the report. “The ChaCha-Poly1305-based encryption key is derived through an ECDH key exchange performed at the time the C2 connection is established.”
The RAT process itself is confined entirely to 127.0.0.1. All external traffic originates from the browser process, not the malware. Blocking the Cloudflare Workers domain used for signaling would disrupt legitimate Cloudflare deployments — a structural problem for defenders trying to take targeted action.
Talos found msaRAT deployed after initial access and before the ransomware encryptor ran, which fits Chaos’s established pattern of pre-encryption reconnaissance.
“As a result of this design, all network communication from the RAT process itself is limited to “127.0.0[.]1”, and all external communications are observed as originating from a legitimate browser process.” concludes the report. “Since browser-based WebRTC communication is commonplace even in enterprise environments, C2 traffic is effectively buried within normal web traffic from the perspective of firewalls and network monitoring tools.”
Detection signals to watch for: a browser process spawned with remote-debugging flags from an MSI installer, curl.exe or certutil.exe activity in C:\ProgramData, and HeadlessChrome user-agent strings in HTTP requests. Talos has published a ClamAV signature (Win.Downloader.ChaosRaas-10060321-0) and Snort rules, with full indicators available in their GitHub repository.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Cisco Talos researchers published a detailed technical report on July 16 disclosing UAT-11795, a financially motivated, Russian-speaking threat actor that has been running a malware campaign against users in the United States and Europe since at least June 2025. The operation distributes trojanized installers for software that IT professionals and developers actually use: MobaXterm, Cisco Webex, Zoom, DBeaver, and even the gaming platform FACEIT.
“Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.” reads the report published by Talos.
The wide range of targets, from developer tools and business collaboration software to gaming platforms, suggests the attackers are trying to infect many different types of users instead of focusing on a single industry.
The campaign delivers two newly documented malware families. The first is Starland RAT, a Python-based remote access tool with credential theft and cryptocurrency wallet enumeration built in. The second is the WLDR agent, a PowerShell-based command-and-control implant that runs entirely in memory. Both are novel. Talos also observed the actor deploying CastleStealer and Remcos RAT as additional payloads delivered through Starland after initial compromise.
Initial access appears to come through a ClickFix social engineering technique, where the victim is tricked into running a command that downloads and executes a malicious HTA file silently. That HTA file drops a Windows batch file and a trojanized installer, while simultaneously establishing persistence through a registry Run key that re-executes the HTA every time the user logs in. A Russian-language developer comment found inside the VBScript, “Добавление команды в автозапуск для текущего пользователя,” confirms the actors are Russian-speaking and, apparently, left their development notes in the deployed code.
The trojanized installers are built using the Nullsoft Scriptable Install System. They package a real Python runtime alongside a compiled Python loader disguised as a file named LICENSE.txt. The NSIS script executes the loader, which decrypts Starland RAT using a single-byte XOR key and runs it directly in memory. The actual software installation proceeds normally, so the victim sees what they expected and has no reason to suspect anything happened.
Before any network activity, Starland checks whether it’s running in a sandbox. It compares the logged-on username against a hardcoded list of known sandbox service accounts including WDAGUtilityAccount, then checks the computer name against hostnames from Cuckoo, Any.Run, Joe Sandbox, and Hybrid Analysis. It also checks for a Zone.Identifier alternate data stream on the installer file to confirm it was downloaded through a browser rather than dropped directly. Any mismatch terminates execution.
“Before any malicious logic executes, the RAT conducts check for anti-analysis environments. First, it compares the logged-on username of the victim machine against a hardcoded list of usernames, which includes known sandbox service accounts and aliases, including WDAGUtilityAccount. Next, the RAT verifies the victim’s computer name against a list of hostnames from recognized sandbox environments, such as Cuckoo, Any.Run, Joe Sandbox, and Hybrid Analysis.” continues the report. “If either check matches, the RAT’s execution terminates immediately. Additionally, the RAT examines the Downloads folder for a Zone.Identifier alternate data stream on the trojanized installer file, confirming that the file was obtained via a browser download rather than being uploaded or copied directly.”
After clearing those checks, the RAT establishes persistence before making any network calls, creating a scheduled task with a randomized name following the pattern PythonLauncher-{3 random characters} and a Startup folder shortcut as a secondary mechanism. It then runs reconnaissance: hardware ID derived from the C: drive volume serial number, total RAM, installed antivirus, and Active Directory membership. If the machine is domain-joined, it executes whoami, systeminfo, net user, and nltest to map the domain structure. It also enumerates over 40 cryptocurrency wallets from both browser extensions and desktop applications, takes a screenshot of the desktop, and bundles everything into a JSON payload that it XOR-encrypts with the key “helo1” before sending it to the C2.
The C2 design is worth calling out. The RAT sends victim registration data to a hardcoded primary C2 domain, but if that fails, it uses a Polygon Ethereum smart contract as a backup.
“If the primary C2 registration fails, the RAT enables a blockchain-anchored fallback mechanism. An eth_call is triggered via JSON-RPC to the public Polygon RPC endpoint “polygon-rpc[.]com”, targeting the smart contract “0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba” and function selector “0xc659f3b8” for the latest block.” states Talos. “The encrypted hexadecimal string that the RAT receives from the smart contract is XOR-decrypted with the key “$m7*rYpry3” to recover a fallback domain to which the RAT sends the victim machine registration request along with the reconnaissance and screenshot data.”
Blocking a C2 domain doesn’t help if the fallback address lives on a public blockchain that you can’t take down.
Before registering with the C2, the RAT sends a Telegram notification to an attacker-controlled bot with the victim’s public IP, OS details, processor information, computer name presented as a “Crew ID,” and any detected cryptocurrency wallets. Two Telegram bots are used: “skuefq_bot” and “komandastuk_bot.” Talos also found a private Telegram channel called “stuk komanda” created June 5, 2025, structured like a C2 dashboard, confirming the operation’s timeline.
When Starland receives a shellexecute command from the C2, the actor can use it to deploy the WLDR framework. This arrives in three stages: a heavily obfuscated PowerShell stager, a downloader that fetches victim-specific payloads bound to the machine’s hardware ID, and the WLDR agent itself, which runs entirely in memory.
“The WLDR agent is a fully featured PowerShell remote access client that operates entirely in memory. It implements encrypted C2 communications, concurrent task execution through a managed Runspace engine, and a module delivery framework that provides the threat actor with interactive remote PowerShell execution capabilities on the victim’s machine.” continues the report.
The WLDR agent uses AES-256-CBC with HMAC-SHA256 for all communication, derives session keys through PBKDF2-SHA256 at 5,000 iterations, and masks its traffic with headers that mimic a Chrome 124 browser session. The Runspace engine supports up to 10 concurrent threads and streams output back to the C2 in real time as scripts execute rather than waiting for completion, making it suitable for interactive monitoring tasks. The C2 responds only to requests that carry a matching hardware ID, so probing the endpoint directly returns nothing useful.
Starland also delivers CastleStealer, a .NET infostealer that targets browser credentials across the full Chromium family and Firefox, cryptocurrency wallet extensions, Discord and Telegram session files, and Steam credentials. It checks for a Russian locale and exits if it matches, which is consistent with the operator protecting their own environment. Remcos RAT is delivered through a separate 32-bit shellcode path. The custom shellcode loader that handles both payloads disables AMSI and ETW at runtime by patching the first bytes of AmsiScanBuffer and EtwEventWrite in memory, then falls back to a VirtualProtect-based write if the primary patching fails, before decompressing and injecting the final payload using reflective PE injection or .NET CLR loading depending on the payload type.
The full indicator set including domains, IPs, file hashes, and Snort rule IDs is available in Talos’ GitHub repository linked from the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, UAT-11795)
Microsoft Threat Intelligence published a detailed analysis on an ongoing hacking campaign against hospitality organizations that has been running since April 2026. The targets are specific: device names observed across compromised environments include strings like “reception,” “frontdesk,” “reservations,” “accueil,” “recepcja,” and “recepce” in English, French, Polish, Czech, and Spanish. The attacker knows exactly who opens guest-related emails without thinking twice about it.
The delivery mechanism is what Microsoft calls authentication laundering.
“The threat actor uses Calendly’s email notification system and Google’s URL redirect functionality to construct a multi-hop delivery chain in which the direct Calendly path passes Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) checks.” reads the report published by Microsoft.
The emails arrive with the display name “Booking Manager (via Calendly)” and carry lures about bedbug infestations, health inspections, guest complaints, final warnings, and threatened suspensions. They came in Japanese, Danish, and Dutch, with Japanese the most common. The researchers observed that the messages have no recipient name, no property name which suggests this is high-volume list-driven sending, not tailored spearphishing.
Upon clicking the embedded link, the victim is routed through four hops: a Calendly redirect to share.google, then to www.google.com, then to a freshly registered Cloudflare-fronted .cfd domain sitting behind a Turnstile challenge. That challenge serves double duty as an anti-analysis gate and a geolocation filter before the payload lands. The downloaded archive contains a shortcut file named IMG-<numbers>.png.lnk in Wave 1 or PHOTO-<numbers>.png.lnk in Wave 2, both sized consistently between 1,989 and 2,079 bytes, suggesting the same builder tool across the campaign.
Opening the shortcut fires PowerShell. The script uses BigInt arithmetic to decode a download URL, a technique that evolved across seven distinct obfuscation phases over the course of the campaign.
“A defining characteristic of this campaign is its steady but disciplined obfuscation evolution. Microsoft observed seven PowerShell obfuscation phases over the course of the campaign, but the underlying logic remained consistent: decode embedded data through arithmetic operations, recover the next-stage content, and retrieve a PowerShell script that runs from the %TEMP% folder.” continues the report. “This pattern suggests that the threat actor is iterating for durability against static detections rather than experimenting with entirely new tradecraft. “
The operators never abandoned PowerShell or Node.js. They just kept re-skinning the same working loader as detections caught up.
The decoded script downloads a legitimate Node.js v24.13.0 runtime from nodejs.org into user space, then runs a JavaScript implant tracked as TonRAT from AppData\Local\Nodejs\. No system-wide Node installation is needed. Wave 2 added an intermediate stage: the downloaded PowerShell script triggers dynamic .NET DLL compilation through csc.exe and cvtres.exe, producing small 3,072-byte DLLs with random names before reaching Node.js. Microsoft assesses this step is preparatory or conditional, as the compiled DLL wasn’t observed being explicitly loaded in available telemetry.
The persistence design is what makes this campaign technically notable.
“The persistence design itself is a meaningful post-compromise observation. The combination of a durable Node.js launch point in HKCU\Run and a repeatedly refreshed ProgramData payload through HKCU\RunOnce suggests an effort to maintain execution options across user sign-ins while also preserving a secondary recovery path.” states Microsoft. “This RunOnce loop is unusual enough that it might provide defenders with a strong hunting pivot even when file names, domains, or script syntax change.”
The RunOnce entry doesn’t fire once and disappear: the payload refreshes its own persistence after each execution, creating a loop. Microsoft observed this in practice: Defender blocked the PE payload xmnrwv9l.exe on a confirmed compromised device, but the Node.js Run key survived. Two days later, the implant reactivated, reconnected to new C2 domains, and resumed pushing additional payloads. Blocking one path left the other alive.
Post-compromise activity on a subset of devices included C2 beaconing to fixed IPs over non-standard ports including 56001, 56002, 56003, 8443, 8445, 8453, and 5555. Some hosts showed headless browser automation with --headless --no-sandbox flags, a geolocation check via ip-api.com, and a forced shutdown through cmd /c shutdown -s -t 0.
The forced shutdown may have served to interrupt user activity, reduce defender response time at a specific stage, or conceal visible symptoms after automated browser tasks completed. Microsoft has not confirmed data theft, ransomware deployment, or named any victims. The campaign’s ultimate objective remains unclear, which is itself a useful piece of information: whoever built this invested heavily in persistence and evasion for something they haven’t shown yet.
Complete remediation requires removing both persistence mechanisms simultaneously: the HKCU\RunOnce entry pointing into ProgramData, the HKCU\Run key pointing to the Node.js component, the Node.js runtime itself, and all associated .js files under AppData\Local\Nodejs\. Start with reception, reservations, and front office systems, and treat any device where Node.js appears in user-space paths as potentially compromised until proven otherwise.
The report includes Indicators of compromise (IoCs) for this campaign.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, hospitality)
Em abril de 2026, descobrimos uma nova campanha destinada a usuários de jogos hentai. Os invasores estão incorporando um cavalo de Troia de acesso remoto chamado Argamal nos instaladores do jogo. Enquanto oculta sua presença, ele pode controlar remotamente o computador e roubar arquivos e dados pessoais.
Veja como evitar ser vítima desse novo cavalo de Troia e como desfrutar de forma segura e anônima de conteúdo picante com (ou sem) garotas de anime.
A maioria dos jogos infectados é distribuída em sites de jogos para adultos e de torrent. Em alguns casos, eles são postados para download em serviços de compartilhamento de arquivos e vinculados em sites de jogos.
Exemplo de jogo trojanizado hospedado no rastreador de torrents AniRena
Curiosamente, em vez de encontrar um arquivo fictício dentro do arquivo compactado, como costuma acontecer, o usuário recebe o jogo real, construído em engines populares como RenPy ou RPG Maker. As versões piratas infectadas geralmente acabam sendo fraudes: os jogos não são iniciados, as pastas estão cheias de arquivos com extensões bizarras, tornando bastante fácil deduzir do que se trata. Aqui, no entanto, o usuário obtém a jogabilidade real que esperava. Enquanto isso, o cavalo de Troia entra e mantém um perfil completamente discreto.
Em alguns casos, os invasores hospedam uma biblioteca de jogos trojanizados em seu próprio site. As vítimas, então, baixam os jogos infectados por meio de um serviço de compartilhamento de arquivos gratuito
Junto com os arquivos legítimos no arquivo compactado, está uma DLL essencial para o funcionamento do jogo, mas ela foi adulterada: assim que o usuário inicia o jogo, a DLL infectada é carregada automaticamente na memória. Não há sinais externos de infecção: nem um instalador aparecendo em segundo plano, nem uma janela assustadora ou solicitação para que você desative o antivírus.
O Argamal age com muita cautela: em vez de se apressar imediatamente para roubar arquivos e senhas ou fazer uma bagunça digital em seu computador, o cavalo de Troia primeiro verifica se está sendo executado em uma máquina virtual ou sandbox e, em seguida, entra no modo de espera.
Durante esse período, o malware grava parâmetros ocultos no sistema, oculta os caminhos para suas DLLs e atrasa sua própria execução. Três dias depois, o computador se conecta ao GitHub, baixa um arquivo criptografado, o descriptografa e o transforma em um módulo de cavalo de Troia funcional.
Para garantir a persistência, os invasores registram o malware na tarefa do sistema WindowsColorSystem Calibration Loader, um recurso interno do Windows que é acionado a cada login do usuário para carregar perfis de cores do monitor. Antes de desligar, o malware exclui arquivos temporários e cobre seus rastros para dificultar ainda mais a detecção.
O Argamal é um Trojan de acesso remoto (RAT), o que significa que os invasores podem usá-lo para controlar remotamente o computador da vítima. Aqui está apenas uma pequena lista do que isso pode implicar:
Essencialmente, o computador infectado se transforma em uma máquina controlada remotamente. O proprietário pode continuar tranquilamente seu dia, sem saber que o dispositivo foi comprometido. No entanto, as consequências dessa infecção podem ser devastadoras.
Por exemplo, uma única senha roubada de uma nota de texto pode levar a várias contas comprometidas de uma só vez se a vítima reutilizar as mesmas credenciais em sites diferentes. É por isso que recomendamos armazenar senhas fortes e exclusivas no cofre criptografado de um gerenciador de senhas em vez de arquivos de texto simples.
Além de sequestrar contas, o cavalo de Troia permite que os invasores literalmente espionem o usuário, lendo seus bate-papos, vasculhando arquivos secretos, estudando suas preferências sexuais… Os cibercriminosos podem, então, usar essas informações altamente confidenciais para ataques subsequentes, chantagem e extorsão. Em uma postagem anterior, já falamos sobre o que fazer se você for alvo de chantagistas.
Outro cenário comum envolve roubar ou substituir em silêncio dados financeiros, por exemplo, interceptar credenciais de aplicativos bancários ou substituir endereços de carteiras de criptomoedas na área de transferência, o que envia todo o seu dinheiro direto para as contas dos invasores.
Em resumo, há uma lista completa de maneiras pelas quais os invasores podem explorar o dispositivo e os dados de uma vítima.
Se você decidiu se tornar o grande mestre do “Waifu Simulator Ultra Definitive Edition”, tome cuidado:
Entrar