The post New “ClickFix” Campaign Bypasses Gatekeeper to Hijack macOS Devices appeared first on Daily CyberSecurity.

Executive Summary

Cyble Research and Intelligence Labs (CRIL) has uncovered a targeted cyberespionage campaign leveraging social engineering and trusted infrastructure to establish persistent, covert access to victim systems.

The attack is delivered via phishing emails containing a malicious LNK file disguised within a RAR archive, using a Russian humanitarian aid request form to exploit contextual trust. Evidence of a secondary survey-based lure indicates the threat actor is actively refining delivery techniques.

Execution triggers a stealthy, multi-stage infection chain in which a decoy document is presented to the user while a heavily obfuscated, fileless (PE-less) Python-based implant is silently deployed.

The payload is retrieved from GitHub Releases, enabling the attacker to blend malicious traffic with legitimate services and evade traditional detection mechanisms. Persistence is established through scheduled tasks, ensuring long-term, resilient access.

Once active, the implant operates as a full-spectrum surveillance platform, enabling credential harvesting, keystroke logging, clipboard and screenshot capture, sensitive data exfiltration, and covert remote access. The campaign prioritizes continuous intelligence collection while maintaining a low operational footprint and minimal user visibility.

While attribution remains inconclusive, the artifacts strongly suggest a deliberate intelligence-gathering operation likely targeting Russian-speaking individuals or entities.

Key Takeaways

• The LNK file contains self-obfuscated content that is extracted and executed by PowerShell, using a deliberate technique to evade automated sandbox analysis.
• Multiple lure types themed around humanitarian aid, written in Russian, have been observed, suggesting the intended targets are Russian-speaking individuals, and the threat actor is actively adapting delivery approaches.
• The payload is obfuscated using PyArmor and hosted on GitHub Releases, a deliberate combination to evade static detection and bypass network-level security controls.
• During analysis, the implant was observed collecting browser credentials, session cookies, keystrokes, clipboard data, screenshots, Telegram session data, and sensitive files from the victim's machine.
• Remote desktop access is established silently using RustDesk or AnyDesk, giving the attacker persistent interactive access to the victim's machine with no visible window.
• Persistence is achieved through a Windows Scheduled Task that survives system reboots, ensuring the implant remains continuously active in the background.
• The threat actor behind this campaign has not been conclusively attributed. The campaign uses a surveillance-first, PE-less Python architecture and custom C2 infrastructure, consistent with a targeted espionage operation.

Technical Analysis

This section provides a detailed walkthrough of the attack chain, from initial delivery to payload execution and data collection, based on static and dynamic analysis of the identified samples.

Stage 1: Malicious LNK File Delivery

The infection begins with a Windows shortcut file delivered to the target.

SHA-256

8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79

The LNK file is significantly larger than a typical Windows shortcut, as it contains self-obfuscated Unicode content embedded within its body. PowerShell reads this content from a specific offset, decodes it, and executes it in memory. This is a deliberate anti-sandbox technique, as the malware will not execute if the original file is absent from disk, making it appear clean to automated scanning tools.

Stage 2: Decoy Lure Delivery

Upon execution, the malware downloads a Russian-language humanitarian aid request form ("O predostavlenii gumanitarnoy pomoshchi") from the C2 server, saves it to %TEMP%\open_doc, and displays it to the victim. The lure of both the RAR archive and the LNK file reference humanitarian aid, reinforcing the lure's credibility.

Lure PDF URL

hxxp://159.198.41[.]140/static/builder/lnk_uploads/invo.pdf

Saved To

%TEMP%\open_doc

While the victim reads the document, the real installation runs silently in the background. A second variant involving a survey link (hxxp[:]//159.198.41.140/test/index.php?r=survey/index&sid=936926&newtest=Y&lang=ru%22) has also been observed.

Stage 3: Python Environment Bootstrap

The malware creates a fully self-contained Python environment inside the user's %appdata% folder, requiring no administrator privileges.

Installation Path

%APPDATA%\WindowsHelper

`The installation directory is named WindowsHelper to mimic a legitimate Windows system component. The malware correctly handles a known technical requirement for Python's embedded distribution (patching the ._pth file to enable pip), a detail that reflects genuine developer skill. The following Python libraries are installed, each enabling a specific capability:

Stage 4: Payload Download and Persistence

The main payload is downloaded from a dedicated GitHub account. Storing it in GitHub Releases rather than the repository code is a deliberate evasion choice, as release artifacts receive less scrutiny from automated scanners and updates can be pushed silently with no commit history. The same account also hosts clean, legitimate files, including the Python embedded runtime and pip installer, making the entire download chain appear as normal GitHub traffic.

Beyond the malicious payload, the same GitHub account also hosts the Python embedded runtime (python-3.12.10-embed-amd64.zip) and the pip installer (get-pip.py) as separate release tags. These are clean, legitimate files. Hosting them on the same repository allows the attacker to download and bootstrap the entire Python environment from a single trusted source, making the full installation chain appear as normal GitHub traffic to network monitoring tools.

The attacker's GitHub Release page shows frequent republishing of data.zip, with its sha256 hash changing across versions, confirming the threat actor remains active and is continuously updating the campaign payload.

Persistence

Two silent VBScript launchers, run.vbs and launch_module.vbs, invoke the payload through pythonw.exe with no visible window.

A Windows Scheduled Task named “WindowsHelper” is registered to run at a short recurring interval, ensuring the implant persists across reboots and remains continuously active in the background.

Stage 5: Active Payload Capabilities

The main payload, module.pyw, is protected with PyArmor v9.2 Pro, a commercial obfuscation tool that converts Python bytecode into a format that resists static analysis and decompilation. Analysis of the disassembled bytecode revealed the following active capabilities:

Browser Credential and Cookie Collection

The implant collects stored passwords and session cookies from all major Chromium-based browsers, including Firefox. For Chromium browsers, it extracts the AES-GCM master key from the Local State file and uses it to decrypt stored credentials. It handles both legacy DPAPI-based decryption and newer Chrome encryption schemes (v10, v11, and v20).

• Target browsers: Chrome, Edge, Brave, Opera, Yandex Browser, Firefox
• Functions identified in bytecode: get_master_key, decrypt_chromium_data, extract_chromium_passwords, collect_and_send_cookies, extract_login_data, extract_firefox_passwords

Keylogging

Keystrokes are captured continuously via the keyboard library, stored in keystrokes_log.txt, and periodically uploaded to the C2 server.

Clipboard Monitoring

The malware monitors clipboard contents in real time using the pyperclip library. Any text copied by the victim, including passwords, tokens, and other sensitive content.

Screenshot Capture

The mss library captures continuous desktop screenshots, which are archived as ZIP files and uploaded periodically. Old archives are automatically cleaned up to avoid excessive disk usage.

File Collection

The implant recursively scans user directories, skipping system folders and low-value file types, to collect documents, configuration files, and credential stores.

This selective filtering is designed to identify high-value files, including documents, configuration files, source code, and credential stores on the Desktop, in Documents, and similar user locations.

A SQLite database inventory_state.db tracks scanned files to avoid re-uploading unchanged content. Files are also scanned for 64-character hexadecimal strings consistent with cryptocurrency private keys.

Telegram Session Collection

The tdata session folder is extracted and uploaded, giving the attacker full access to the victim's Telegram account without requiring a password.

Remote Access via RustDesk and AnyDesk

Static analysis of the payload reveals the capability to silently download and install RustDesk and AnyDesk. RustDesk, signed by Open Source Developer Huabing Zhou, is a legitimate remote desktop tool that is being abused here to blend in with normal software. The code is designed to hide the application window from the victim and to send the connection credentials back to the C2 server, potentially giving the attacker persistent remote desktop access.

RustDesk download source

hxxps://github.com/rustdesk/rustdesk/releases/download/1.4.4/rustdesk-1.4.4-x86_64.exe

Command and Control Infrastructure

All collected data is transmitted to a single attacker-controlled server. The server hosts a custom-built login panel (Login - Dashboard) that the attacker can use to access all collected data, monitor active implants, and initiate remote desktop sessions.

C2 Server

hxxp://159.198.41[.]140

Server Stack

nginx/1.24.0 on Ubuntu Linux, Flask 3.1.3 backend, Python 3.12.3

Hosting Provider

Namecheap, Inc. (web-hosting.com VPS) - ASN 22612, Atlanta, GA, USA

Upload Endpoint

/upload

Tunnel Endpoint

/tunnel (RustDesk proxy)

User-Agent Spoofed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... Chrome/143.0.0.0 ... Edg/143.0.0.0

The C2 server was confirmed live and serving the attacker's login panel as of May 2026. The use of a commercial VPS provider with low-friction provisioning reflects a common pattern among threat actors seeking to quickly deploy and replace infrastructure.

Attribution:

The intended targets of this campaign appear to be Russian-speaking individuals, as evidenced by the Russian-language lure content referencing humanitarian aid. The use of a humanitarian aid application form as a decoy suggests the targets may include individuals or organizations involved in aid distribution, civil administration, or related government functions.

Conclusion

This campaign represents a well-constructed, technically capable cyberespionage operation. The attacker combines a convincing Russian-language humanitarian aid lure with a multi-stage infection chain that silently deploys a full-featured surveillance platform on victim machines.

The Python implant goes beyond credential collection. It enables the attacker to monitor every action a victim takes, collect active browser sessions, capture communications, and maintain live remote desktop access.

The use of PyArmor v9.2 Pro for payload obfuscation, GitHub Releases for payload hosting, and a custom Flask C2 panel demonstrates a technically skilled and operationally disciplined threat actor.

The campaign is active and ongoing. The Russian-language lure content and humanitarian aid theme point to Russian-speaking individuals as the intended target audience.

The use of multiple lure types, particularly humanitarian ones, indicates active development and adaptation. Organizations and individuals should treat this as an active threat and apply the recommendations in this report.

Recommendations

• Treat unsolicited files received through email or messaging platforms with caution, especially compressed archives and shortcut files. Verify the sender through a separate trusted channel before opening any attachment.
• Enable file extension visibility in Windows to prevent files from being disguised using misleading names or double extensions.
• Regularly audit the Windows Task Scheduler for unexpected or newly created tasks, particularly those scheduled to run at short, recurring intervals without a known business justification.
• Monitor endpoint activity for the creation of self-contained scripting environments in user-writable directories, as this is a common technique for executing malicious code without administrative privileges.
• Block outbound network traffic to known malicious infrastructure at the perimeter and alert on downloads from newly registered or low-reputation hosting accounts on code-sharing platforms.
• Monitor for the silent installation of remote desktop tools by non-administrative processes, as legitimate software abused for remote access is a growing attacker technique that can be difficult to detect without process-level visibility.
• Deploy endpoint detection rules targeting obfuscated or packed script files appearing in non-standard user directories, as commercially packed payloads are increasingly used to evade static analysis.
• Ensure security teams have visibility into scheduled task creation, scripting interpreter activity, and outbound HTTP connections from user-space processes, as these are the primary indicators of this class of threat.

MITRE ATT&CK TTPs

Tactic (Tactic ID)	Technique (Technique ID)	Description
Initial Access (TA0001)	Phishing: Spearphishing Attachment (T1566.001)	Malicious LNK file inside a RAR archive, delivered as a Russian-language humanitarian aid
Execution (TA0002)	User Execution: Malicious File (T1204.002)	The victim must open the LNK file to trigger the infection chain
Execution (TA0002)	Command and Scripting Interpreter: PowerShell (T1059.001)	PowerShell reads content from a specific offset within the LNK file and executes the obfuscated payload
Execution (TA0002)	Command and Scripting Interpreter: VBScript (T1059.005)	run.vbs and launch_module.vbs silently invokes the Python payload with no visible window
Execution (TA0002)	Command and Scripting Interpreter: Python (T1059.006)	Core surveillance implant written in Python, executed via windowless pythonw.exe
Persistence (TA0003)	Scheduled Task/Job: Scheduled Task (T1053.005)	WindowsHelper scheduled task fires every 5 minutes indefinitely and survives system reboots.
Defense Evasion (TA0005)	Obfuscated Files or Information: Software Packing (T1027.002)	Python payload packed with PyArmor v9.2 Pro to resist static analysis and decompilation
Defense Evasion (TA0005)	Masquerading: Match Legitimate Name or Location (T1036.005)	WindowsHelper directory name mimics a legitimate Windows system component
Defense Evasion (TA0005)	Ingress Tool Transfer (T1105)	Payload (data.zip) downloaded at runtime from GitHub Releases, abusing trusted infrastructure.
Credential Access (TA0006)	Credentials from Password Stores: Credentials from Web Browsers (T1555.003)	Collects stored passwords and cookies from Chrome, Edge, Brave, Opera, Yandex Browser, and Firefox
Credential Access (TA0006)	Steal Web Session Cookie (T1539)	Session cookies collected
Credential Access (TA0006)	Unsecured Credentials: Credentials in Files (T1552.001)	Scans for files containing 64-character hex strings consistent with private keys
Collection (TA0009)	Input Capture: Keylogging (T1056.001)	The keyboard library captures all keystrokes continuously and stores them for upload.
Collection (TA0009)	Clipboard Data (T1115)	pyperclip monitors and collects clipboard contents in real time
Collection (TA0009)	Screen Capture (T1113)	mss library takes continuous desktop screenshots and archives
Collection (TA0009)	Data from Local System (T1005)	A selective recursive scan collects documents and configuration files from user directories.
Command and Control (TA0011)	Application Layer Protocol: Web Protocols (T1071.001)	HTTP used to upload all collected data to the C2 server at 159.198.41[.]140
Lateral Movement / Persistence (TA0008)	Remote Access Software (T1219)	RustDesk and AnyDesk are silently installed for persistent interactive remote desktop access.
Exfiltration (TA0010)	Exfiltration Over C2 Channel (T1041)	All collected data was uploaded to the attacker-controlled C2 server in batched archives.

Indicators of Compromise (IOCs)

Indicator	Indicator Type	Description
8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79	SHA-256	Initial LNK dropper
9be61c95056fd6b63565cf51a196f2615f5360c0a42e616b2a618473e9d60a21	SHA-256	Dementyeva_Anna_Vasilyevna_zayavka_gumanitarnayapomosch.rar
hxxp://159.198.41.140/static/builder/lnk_uploads/invo[.]pdf	URL	Lure PDF download
hxxp://159.198.41.140/test/index.php?r=survey/index&sid=936926&newtest=Y&lang=ru%22	URL	Survey URL
hxxps://github.com/leravalera2/dtfls/releases/download/dtfls/data.zip	URL	PyArmour packed malicious scripts
a5b782901829861a6f458db404e8ec1a99c65a48393525e681742bb2a5db454d	SHA-256	module.pyw - packed Python stealer/RAT

The post Operation HumanitarianBait: An Infostealer Campaign in Disguise appeared first on Cyble.

Cybersecurity expert Tom Rønning finds Microsoft Edge loads all saved passwords into computer memory as cleartext, making them easy for hackers to steal.

💾

Attackers have found a way to intercept SMS-based one-time passwords from a victim's mobile device without deploying a single line of malware on the phone itself. Instead, they go through the Windows PC the phone is already connected to.

Researchers documented an active intrusion campaign active since at least January 2026, that combines a remote access trojan called "CloudZ" with a previously undocumented plugin named "Pheno." Together the two tools are designed to steal credentials and harvest authentication codes that arrive on a victim's phone by abusing Microsoft Phone Link, a legitimate Windows application built into every Windows 10 and 11 system.

Microsoft Phone Link, formerly "Your Phone," is a synchronization tool that bridges a user's Android or iOS device to their Windows PC, mirroring calls, messages, and app notifications directly onto the desktop.

Pheno exploits that bridge. It continuously scans running processes for keywords including "YourPhone," "PhoneExperienceHost," and "Link to Windows" to detect an active phone connection. When one is found, the plugin writes "Maybe connected" to a local staging file and gains access to the Phone Link application's local SQLite database. It is a file that can contain SMS messages and authenticator app notification content, including OTP codes.

The attack never targets the mobile device directly. It targets the enterprise-managed Windows endpoint the device trusts, bypassing security controls focused on securing smartphones rather than the desktop layer they sync with.

Also read: Infostealers and Lack of MFA Led to Dozens of Major Breaches

CloudZ is a modular .NET RAT compiled on January 13, and obfuscated with ConfuserEx. Beyond loading Pheno, it supports credential harvesting from web browsers, file operations, remote command execution, and host profiling.

It establishes an encrypted TCP connection to its command-and-control server and rotates between three hardcoded user-agent strings to make its traffic blend with legitimate browser requests. To evade analysis, CloudZ detects .NET debuggers and profilers via environment variable queries and generates its executable functions dynamically in memory — meaning the most sensitive code never sits as a static binary on disk.

The infection chain begins with a fake ScreenConnect application update. ScreenConnect is a legitimate remote support tool commonly used in enterprise environments. Executing the fake update drops a Rust-compiled loader, which in turn deploys a .NET loader that installs CloudZ and establishes persistence via a scheduled task. The .NET loader performs thorough sandbox checks, scanning for analysis tools including Wireshark, Fiddler, Procmon, and Sysmon before proceeding.

Cisco Talos researchers did not attribute the campaign to a known threat actor. The initial access vector also remains unidentified.

Unit 42 uncovers high-risk AI browser extensions. Disguised as productivity tools, they steal data, intercept prompts, and exfiltrate passwords. Protect your browser.

The post That AI Extension Helping You Write Emails? It’s Reading Them First appeared first on Unit 42.

The post Inside the Stealthy Evolution of Vidar Infostealer appeared first on Daily CyberSecurity.

New version of Vidar infostealer spreads via fake CAPTCHAs, hides in JPEG and TXT files, uses fileless attacks and steals browser, crypto wallet data.

Fake Antigravity downloads are enabling fast account takeovers using hidden malware and stolen session cookies.

The post Fake Google Antigravity Installer Can Steal Accounts in Minutes appeared first on TechRepublic.

Description. this report analyzes Infostealer distribution trends and cases collected during the month of March 2026. It is based on data collected through ASEC’s automated collection and analysis system and ATIP’s real-time IOC service. Purpose and Scope. the purpose of the analysis is to identify trends in the volume, distribution methods, and disguising techniques. the […]

Google adds Device Bound Session Credentials (DBSC) to Chrome 146, using hardware keys to block infostealer use of stolen session cookies on Windows.

New research from Varonis Threat Labs reveals Storm infostealer, a malicious subscription service that bypasses Google Chrome encryption.…

TeamPCP continues its string of supply chain attacks, and announces a partnership with Vect ransomware group.

The post Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure appeared first on Unit 42.

Overview AhnLab SEcurity intelligence Center (ASEC) recently identified a change in the Kimsuky group’s method of distributing malicious LNK files. The overall attack flow remains the same as before, with a malicious LNK ultimately executing a Python-based backdoor or downloader. However, a structural change was observed in the intermediate execution phase.   Category Previous Distribution […]

Executive Summary

CRIL has been actively tracking a surge in PXA Stealer activity deployed in a sophisticated, financially motivated threat campaign attributed with high confidence to a Vietnam-based cybercriminal group. The primary targets in this campaign are job seekers across India, Bangladesh, the Netherlands, Sweden, and the United States.

Threat actors leverage LinkedIn as their primary initial access vector, distributing fraudulent recruitment messages via compromised accounts that impersonate legitimate job opportunities.

What makes this threat particularly dangerous is the potential for propagation: compromising one’s LinkedIn account, especially with many connections (such as recruiters or HR personnel), can lead to an exponentially higher rate of further infection. This new trend requires users to be wary when using any social networking platform, even those for professional use.

The infection ultimately delivers a multi-stage information stealer designed to harvest sensitive data, including browser-stored credentials, cryptocurrency wallet information, two-factor authentication (2FA) tokens, hardware wallet artifacts, and email client credentials.

The attack chain demonstrates significant operational sophistication:

• Adversaries abuse trusted cloud and professional platforms—including LinkedIn, Google Forms, and Dropbox—to evade reputation-based security controls and increase victim trust.
• Execution relies on a legitimate Microsoft 365 binary leveraged for DLL sideloading, while the malicious DLL is artificially inflated to approximately 100 MB to bypass size-based inspection mechanisms.
• The final payload executes entirely in memory, minimizing disk artifacts and complicating forensic detection.

This sophistication makes PXA Stealer a potent threat to job seekers in the targeted countries, and the list of victims may expand in the near future.

At the time of analysis, the campaign remained active and continued to propagate laterally through compromised LinkedIn accounts, leveraging victims’ professional networks to further distribute job-themed phishing lures.

The image below shows the Malware profile summary for PXA Stealer from Cyble’s Vision Threat Intelligence.

The real-world impact of this lateral spread is evidenced by multiple LinkedIn users publicly reporting that their accounts were compromised and used to distribute fraudulent Apex Logistics Group recruitment messages to their professional connections, as shown below.

Key Takeaways

• Attribution: The campaign is attributed with high confidence to PXA Stealer, tied to a Vietnam-based cybercriminal actor. This is further supported by Vietnamese-language strings embedded within malware samples and overlaps with previously documented activity clusters.
• Initial Access Vector: Threat actors initiate compromise through LinkedIn direct messages, impersonating recruiters from a fabricated logistics entity, Apex Logistics Group, using job-themed social engineering lures.
• Payload Delivery Chain: Victims are redirected through a staged delivery workflow that includes a Google Form, followed by a shortened URL pointing to a Dropbox-hosted ZIP archive. The payload exhibited zero antivirus detections on VirusTotal at the time of discovery.
• Execution Mechanism: Malware executes via DLL sideloading using a legitimate, signed Microsoft Office binary (winword.exe), enabling trusted-process execution and reducing behavioral suspicion.
• Defense Evasion: The malicious DLL is artificially inflated to approximately 100 MB to evade size-threshold scanning mechanisms. The final payload executes entirely in memory through Python exec() functionality, leaving minimal disk artifacts during runtime.
• Command-and-Control (C2): The malware dynamically retrieves its C2 infrastructure from an encrypted Telegram channel. The final payload is hosted on an IP address configured to masquerade as Chinese government infrastructure, likely to hinder attribution and evade network reputation controls.
• Objectives: The infostealer’s primary objective is data theft, targeting a broad range of sensitive assets, including:
  • Browser credentials and session data
  • Cryptocurrency wallets and Ledger Live artifacts
  • Two-factor authentication (2FA) and authenticator data
  • Desktop and email client credentials

• Persistence Mechanism: Persistence is established via a scheduled task registered under a name mimicking a legitimate Microsoft Edge update process, blending malicious activity with normal system operations.

Overview

PXA stealer is tied to a Vietnam-linked threat actor who conducted a targeted campaign across multiple countries by impersonating recruiters on LinkedIn and distributing fabricated part-time job opportunities as social engineering lures.

Victims are guided through a staged delivery chain leveraging trusted platforms, including a Google Form, a shortened URL, and a Dropbox-hosted ZIP archive, allowing the malicious payload to evade reputation-based defenses and achieve zero detections on VirusTotal at the time of discovery.

Upon opening the archive, victims unknowingly executed a disguised Microsoft Word binary that initiated a DLL sideloading attack. The sideloaded DLL is artificially inflated to approximately 100 MB, a deliberate evasion technique designed to bypass automated file-scanning and size-threshold inspection mechanisms.

A concealed batch script subsequently deployed the next-stage payload, established persistence via a scheduled task masquerading as a legitimate Microsoft Edge update process. It launched the final infostealer entirely in memory. Execution relied on multiple layers of encoding—including XOR, Base64, bzip2, and zlib—to obscure payload functionality and minimize forensic artifacts on disk.

PXA Stealer: History and Evolution

PXA Stealer is not a new threat. First publicly documented by Cisco Talos in November 2024, it has undergone continuous, rapid evolution. What began as a straightforward Python-based infostealer has matured into a sophisticated, multi-stage operation backed by an organized criminal ecosystem. Understanding this evolution is critical to anticipating the threat actor's next moves.

The name PXA is tied directly to its original developer, Phan Xuan Anh (PXA), a Vietnamese national who commissioned a high school programmer to develop the malware in late 2024. Vietnamese law enforcement subsequently indicted 12 suspects in early 2026, including the student developer, as part of a global operation that had infected over 94,000 computers worldwide.

Period	Milestone / Version	Key Changes & Observed TTPs
Oct-24	Early Infrastructure Seeding	Telegram BotIDs created; initial Python-based stealer circulated in Vietnamese cybercrime Telegram channels ("Mua Bán Scan MINI"). Handle @LoneNone hardcoded in payload.
Nov-24	Public Discovery (v1.0)	Cisco Talos publishes first analysis. Targets: government & education sectors in Europe and Asia. Lure: phishing emails. Exfiltration via Telegram bot. Vietnamese-language strings confirmed.
Late 2024	Initial LinkedIn Campaign	Pivot to LinkedIn DMs impersonating recruiters. Delivery chain: LinkedIn → Google Form → shortened URL → Dropbox ZIP. Microsoft Office (winword.exe) DLL sideloading introduced. DLL inflated to ~100 MB.
Apr-25	Sideloading Expansion	Actors adopt Haihaisoft PDF Reader as an alternative sideloading vehicle alongside winword.exe. Persistence shifts to the Windows Registry. LummaC2 and Rhadamanthys were delivered alongside PXA in the same campaigns.
Mid 2025	Infrastructure Hardening	Dynamic C2 retrieval via Telegram encrypted channels. C2 IPs configured to masquerade as Chinese government infrastructure. In-memory Python exec() execution introduced; no disk artifacts at runtime.
Jul-25	Advanced Evasion (v2.0+)	Multi-layer encoding stack: XOR → Base64 → bzip2 → zlib. Cloudflare Workers are used as a C2 relay. Exfiltrated data format: [CC_IP] HOSTNAME.zip. 4,000+ unique victim IPs across 62 countries confirmed.
Aug-25	Scale Confirmed (SentinelOne / Beazley)	Joint report: 200,000+ unique passwords, 4M+ browser cookies, hundreds of credit card records harvested. Stolen data is sold on the Sherlock marketplace via a subscription model. 4,000+ victim IPs across 62 countries.
Late 2025	RAT Pivot (Huntress Research)	The same threat actor pivots from a custom Python stealer to PureRAT (a commercial .NET backdoor) in some campaigns. Adds: PureMiner, PureClipper, BlueLoader. C2 servers confirmed in Vietnam.
Oct–Dec 2025	Financial Sector Targeting	Microsoft Defender Experts investigate two campaigns targeting financial institutions. Persistence via registry Run keys and scheduled tasks. Python interpreter masqueraded as svchost.exe.
Q1 2026	Infostealer Vacuum Fill	Following the 2025 takedowns of Lumma, Rhadamanthys, and RedLine, PXA Stealer activity surged by 8–10%. New lures: tax forms, legal documents, and Photoshop installers. Financial institutions globally targeted (CyberProof).
Ongoing	Active Campaign (This Report)	LinkedIn job-lure campaign active across India, Bangladesh, the Netherlands, Sweden, USA. Lateral spread through the victim's LinkedIn connections. CRIL is actively tracking.

Comparative TTP Analysis: PXA Stealer Campaigns

The table below cross-references TTPs observed in this campaign against prior PXA Stealer analyses by Cisco Talos (November 2024) and SentinelOne (August 2025). The consistent overlap across delivery, obfuscation, persistence, and exfiltration techniques provides strong technical justification for attributing this activity to the PXA Stealer malware family.

TTP	MITRE Technique	Description
Python-Based Infostealer Payload	T1059.006 - Command and Scripting Interpreter: Python	Core PXA Stealer signature across all known campaigns
DLL Sideloading via Legitimate Signed Binary	T1574.002 - DLL Side-Loading	Consistent technique; signed binary name varies by campaign
Hidden Folder with Staged Payloads	T1564.001 - Hide Artifacts: Hidden Files and Directories	Hidden staging folder with an identical naming convention
WinRAR Renamed as an Image File	T1036.005 - Masquerading: Match Legitimate Name or Location	Same technique; only the filename differs
Password-Protected Archive as Payload Container	T1027 - Obfuscated Files or Information	Archive disguised as a common file type in all campaigns
Telegram Bot for C2 or Data Exfiltration	T1071.001 - Application Layer Protocol: Web Protocols	Hardcoded TOKEN_BOT and CHAT_ID across all variants
Vietnamese Language Strings in Payload	T1027 - Obfuscated Files or Information	Attribution marker present in all documented PXA campaigns
Renamed Python Interpreter	T1036.005 - Masquerading: Match Legitimate Name or Location	Python interpreter masqueraded as a system process
Scheduled Task or Registry Persistence	T1053.005 - Scheduled Task / T1547.001 - Registry Run Keys	Persistence method; mechanism varies slightly by variant
Multi-Layer Payload Obfuscation	T1027 - Obfuscated Files or Information	Layered encoding is a consistent anti-analysis signature
Dropbox Used for Payload Staging	T1102 - Web Service	Trusted cloud platform abused as a payload host across campaigns
Browser Credential and Cookie Theft	T1555.003 - Credentials from Password Stores: Credentials from Web Browsers	Core stealer capability is present in all PXA variants.
Cryptocurrency Wallet Targeting	T1414 - Steal Application Access Token	Crypto targeting is a defining objective of PXA Stealer

What Should Businesses Expect When Infected with PXA Stealer?

PXA Stealer's immediate impact is severe and rapid. Within minutes of execution, all browser-stored credentials, active session cookies, cryptocurrency wallets, and 2FA tokens are exfiltrated. Attackers can bypass MFA entirely using harvested session cookies, and email account access enables Business Email Compromise before the victim even notices the infection.

Shortly thereafter, the victims' credentials are stolen, and their own LinkedIn profile is turned into a distribution channel for further attacks.

Organizations face regulatory breaches of notification requirements under GDPR or DPDPA, long-term persistent access risks, and lasting reputational damage, particularly for fintech and crypto-facing businesses.

Technical Analysis:

Initial Access — LinkedIn Phishing

The threat actor established initial contact via direct messages on a compromised LinkedIn account, posing as a recruiter affiliated with a logistics sector firm. The lure offered a remote, part-time digital marketing role, a format deliberately calibrated to exploit the professional context LinkedIn provides.

With 1.3 billion active users, LinkedIn is the largest professional networking platform. Users would naturally expect and engage with career-related outreach, particularly job seekers. This significantly lowers their caution threshold when compared to unsolicited emails or social media messages from trusted contacts on other platforms.

Once contact is established, targets are directed to a Google Form hosted at hxxps://forms.gle/JjAtpy26Tcokow2Q7.

Hosting the next stage on Google’s legitimate infrastructure is intentional: most URL filtering solutions and email security gateways do not flag Google domains, allowing the attacker to preserve the job application narrative while bypassing automated defenses entirely.

Payload Delivery — Trusted Platforms as Staging Infrastructure

Within the Google Form, victims were instructed to review a job description via a hyperlink. The link (hxxps://tr.ee/PRtnsf) was a shortened URL that redirected to a Dropbox-hosted ZIP archive named “Position Details and Compensation Policy (2).zip”. The layering of a URL shortener on top of a trusted cloud storage platform made static analysis significantly more difficult. At the same time, the job-themed filename gave victims no reason to hesitate before opening it.

The downloaded archive registered zero detections on VirusTotal at the time of analysis, demonstrating the effectiveness of this multi-platform delivery chain against conventional security tooling.

Archive Contents — Concealment by Design

Once extracted, the archive presented the victim with a single visible file: what appeared to be a legitimate Microsoft Word executable. All remaining components were deliberately hidden within the archive, including:

• A malicious DLL (AppvIsvSubsystems64.dll)
• Supporting runtime files
• A batch script (en.cmd / en.pip)
• A decoy Word document
• A hidden folder named “__” containing next-stage components (Invoice.pdf, Trend.jpg, support.ico, nsedge.exe, update.dll)

DLL Sideloading:

Executing the visible file — Position Details and Compensation Policy.EXE (a renamed winword.exe) — triggered a DLL sideloading attack. The malicious AppvIsvSubsystems64.dll was loaded in place of the legitimate Microsoft Office counterpart of the same name.

What distinguishes this DLL File is its file size. The clean, signed version of this DLL typically ranges between 1 MB and 3 MB. The malicious variant was deliberately inflated to approximately 100 MB. This technique — known as binary padding — is specifically designed to evade automated scanning pipelines and static analysis tools that impose file size thresholds or skip oversized files to conserve processing resources.

Batch Script Execution and Persistence

Despite its inflated size, the malicious DLL had a single task: copy "en.pip" to "en.cmd" and execute it. From there, the batch script extracted a next-stage payload from a password-protected archive disguised as "Invoice.pdf" into %LOCALAPPDATA%\Microsoft\WindowsApps, deleted the archive and extraction utility to reduce forensic traces, and registered a scheduled task for persistence.

The final payload was launched through a Python executable named "nsedge.exe" alongside "update.dll", both placed inside %LOCALAPPDATA%\Microsoft\WindowsApps. The masquerade here operated on two levels: the folder path mimicked a legitimate Microsoft Edge installation directory. At the same time, the filenames were chosen to resemble trusted Edge components, making the entire setup appear as routine system activity to both analysts and automated detection tools. (See Figure 6)

Multi-Layer Encoding

Despite carrying a DLL extension, "update.dll" was in fact a Python script, executed with the parameter "sunset". Its role was to read encrypted content from a file named "support.ico", decode it using a key embedded within the file itself, and execute the resulting deobfuscated Python script directly in memory using Python's exec() method, leaving no additional files on disk for forensic tools to recover.

The XOR-decoded content was not the final layer. Underneath it was Python bytecode that had been Base64-encoded and compressed with both bzip2 and zlib. In simple terms, the attacker wrapped the malicious code in multiple layers, one inside the other, making it harder and more time-consuming for analysts to unpack and understand what the malware was actually doing.

Command and Control — Telegram-Based Dynamic Infrastructure

Once the final payload executed, the malware contacted a Telegram channel (hxxps://t.me/erik22sucbot) to retrieve the address of its command-and-control (C2) server. Rather than hardcoding the C2 address — a static indicator that can be blocked after discovery — the attacker stored it on Telegram in encrypted form. The malware decrypted the address at runtime, allowing the attacker to rotate infrastructure without recompiling or redeploying the payload.

Using the “sunset” parameter, the script constructed a download URL (hxxp://151.243.109.125/support/links/sunset[.]txt) to retrieve the final stage payload. The IP address 151[.]243[.]109[.]125 is configured to redirect to a Chinese government website — an additional layer of masquerading intended to cast doubt on analyst findings and create the false impression that the payload was hosted on legitimate government infrastructure.

The downloaded file "sunset.txt" was not a text file despite its .txt extension. It was, in fact, a Python script, heavily obfuscated to resist analysis.

Python Bytecode analysis

From the memory strings, we observed the following: it tries to steal the following items.

Category	Target	Details
Browser Wallet Extension	MetaMask	nkbihfbeogaeaoehlefnkodbefgpgknn
	TronLink	ibnejdfjmmkpcnlpebklmnkoeoihofec
	Binance Chain Wallet	fhbohimaelbohpjbbldcngcnapndodjp
	Phantom	bfnaelmomeimhlpmgjnjophhpkkoljpa
	Coinbase Wallet	hnfanknocfeofbddgcijnmhnfnkdnaad
	Trust Wallet	egjidjbpglichdcondbcbdnbeeppgdph
	Exodus Web3	aholpfdialjgjfhomihkjbmgjidlcdno
	Ronin Wallet	fnjhmkhhmkbjkkabndcnnogagogbneec
	Math Wallet	hpglfhgfnhbgpjdenjgmdgoeiappafln
	Guarda	aeachknmefphepccionboohckonoeemg
	Keplr	dmkamcknogkgcdfhhbddcghachkejeap
	BitKeep	jiidiaalihmmhddjgbnbgdfflelocpak
	XDEFI Wallet	hmeobnfnfcmdkdcmlblgagmfpfboieaf
	Yoroi	Cjelfplplebdjjenllpjcblmjkfcffne
	Jaxx Liberty	fihkakfobkmkjojpchpfgcmhfjnmnfpi
2FA & Authenticator	Authy	gaedmjdfmmahhbjefcbgaolhhanlaolb
	GAuth Authenticator	ilgcnhelpchnceeipipijaljkblbcobl
	Authenticator	bhghoamapcdpbohphigoooaddinpkbai
	EOS Authenticator	oeljdldpnmdbchonielidgobddffflal
	Trezor Password Manager	imloifkgjagghnncjkhggdhalmcnfklk
Browser	Google Chrome	Google\Chrome\User Data
	Microsoft Edge	Microsoft\Edge\User Data
	Brave	BraveSoftware\Brave-Browser\User Data
	Chromium	Chromium\User Data
	QQ Browser	Tencent\QQBrowser\User Data
	Vivaldi	Vivaldi\User Data
	Comodo Dragon	Comodo\Dragon\User Data
	Epic Privacy Browser	Epic Privacy Browser\User Data
	CocCoc	CocCoc\Browser\User Data
Desktop Wallet	Bitcoin-Qt	Software\Bitcoin\Bitcoin-Qt
	Dash-Qt	Software\Dash\Dash-Qt
	Litecoin-Qt	Software\Litecoin\Litecoin-Qt
	Electrum	Electrum
	Ethereum	Ethereum\keystore
	Exodus	exodus.wallet
	Jaxx	com.liberty.jaxx
	Atomic Wallet	atomic\Local Storage\leveldb
	Zcash	Zcash
Application	Telegram Desktop	Session data
	Foxmail	Email client credentials
	Ledger Live	Hardware wallet manager

Network traffic analysis reveals that sensitive data is being exfiltrated to the external IP address 15.235.156[.]143 over port 56001. Outbound communication is concealed within TLS-encrypted traffic, effectively masking its contents and evading content-based inspection. This encryption layer suggests a deliberate attempt to obfuscate data exfiltration, making it difficult to detect with standard deep packet inspection techniques.

Conclusion

PXA’s evolution into a mature, multi-layered attack operation is a concerning development, as it exploits trust at every stage of the kill chain, from the professional credibility of LinkedIn to the reputation of Google, Dropbox, and Microsoft Office binaries.

The threat actors behind this campaign demonstrate strong operational security awareness, evidenced by the deliberate use of legitimate platforms to avoid detection, in-memory payload execution that leaves no on-disk artifacts, dynamic C2 infrastructure managed through Telegram, and multi-layer encoding to resist reverse engineering.

The campaign's continued propagation through victim LinkedIn connections creates a compounding distribution effect: each compromised account becomes a new, trusted sender for the job-lure message, extending the campaign's reach without additional infrastructure investment from the threat actor.

Job seekers, HR professionals, and employees actively engaged on LinkedIn represent the highest-risk population. Organizations in India, Bangladesh, the Netherlands, Sweden, and the United States should treat this campaign as an active threat.

How can Cyble help?

Cyble Vision can help detect compromised credentials and endpoints, monitor known threats, and supplement SOC teams with proactive intelligence to help avoid them even before they are targeted.

A competitive CTI solution, such as Vision, helps users stay a step ahead of threats originating from the surface, deep, and dark web through timely intel, low signal-to-noise ratio, and specific support in the event of an incident or compromise.

Recommendations

• Verify Recruiter Identities Independently: Always confirm recruiter profiles and company legitimacy through official websites or direct calls before engaging with any job offer received via LinkedIn DMs.
• Never Open Unsolicited File Attachments: Do not download or execute ZIP archives, EXE files, or documents received through job application links, even if they appear to come from a trusted connection.
• Enable Multi-Factor Authentication (MFA): Enable MFA on LinkedIn, email, and all critical accounts. Prefer hardware security keys over app-based TOTP, as infostealers can harvest authenticator tokens
• Audit Your LinkedIn Active Sessions Regularly: Periodically review active sessions and connected devices in LinkedIn security settings. Immediately revoke any unrecognised sessions.
• Keep Endpoint Security Tools Updated: Ensure EDR and antivirus solutions are active and up to date. Deploy solutions capable of detecting DLL sideloading, anomalous Python execution, and large, oversized DLL files.
• Monitor for Suspicious Scheduled Tasks: Regularly audit scheduled tasks on endpoints. Flag any tasks with names that mimic legitimate system processes, such as Microsoft Edge update services.
• Educate Employees on LinkedIn-Based Social Engineering: Include LinkedIn phishing scenarios in regular security awareness training. Employees should understand that professional platforms are actively exploited as initial access vectors
• Report and Revoke Immediately if Compromised: If your LinkedIn account is suspected to be compromised, immediately revoke all active sessions, reset credentials, notify your connections, and report the incident to LinkedIn and your security team.

MITRE ATT&CK Mapping

Tactic	Technique	Description
Initial Access (TA0001)	Phishing: Spearphishing Link (T1566.002)	LinkedIn DM with job lure linking to Google Form and Dropbox-hosted payload
Execution (TA0002)	User Execution: Malicious File (T1204.002)	The victim manually executes the disguised WinWord.exe from the downloaded ZIP.
Execution (TA0002)	Command and Scripting Interpreter: Windows Command Shell (T1059.003)	Malicious logic executed via en.cmd batch script
Persistence (TA0003)	Scheduled Task/Job: Scheduled Task (T1053.005)	Scheduled task created for persistence across reboots
Defense Evasion (TA0005)	DLL Side-Loading (T1574.002)	Malicious AppvIsvSubsystems64.dll loaded in place of the legitimate Microsoft Office DLL.
Defense Evasion (TA0005)	Obfuscated Files or Information: Binary Padding (T1027.001)	DLL inflated to ~100 MB to bypass file size thresholds in automated scanners
Defense Evasion (TA0005)	Obfuscated Files or Information (T1027)	Payload concealed inside a password-protected archive named Invoice.pdf
Defense Evasion (TA0005)	Indicator Removal: File Deletion (T1070.004)	The archive and extraction utility deleted post-execution to reduce forensic artifacts.
Defense Evasion (TA0005)	Masquerading: Match Legitimate Name or Location (T1036.005)	Python executable renamed to nsedge.exe; files placed in a legitimate-looking Edge directory
Defense Evasion (TA0005)	Data Encoding: Standard Encoding (T1132.001)	Payload encoded with XOR, Base64, bzip2, and zlib across multiple layers
Execution (TA0002)	Shared Modules (T1129)	Malicious update.dll (Python script) loaded to execute next-stage payload
Command and Control (TA0011)	Application Layer Protocol: Web Protocols (T1071.001)	C2 communication over HTTP/S; Telegram used for dynamic C2 address retrieval
Credential Access (TA0006)	Credentials from Password Stores: Credentials from Web Browsers (T1555.003)	Browser credential stores targeted across Chrome, Edge, Brave, and others

The post Professional Networks Under Attack: Vietnam-Linked Actors Deploy PXA Stealer in Global Infostealer Campaign appeared first on Cyble.

A fake Avast scan tells you your PC is infected, then installs the malware that steals passwords, session data and crypto wallets.

The post Bogus Avast website fakes virus scan, installs Venom Stealer instead appeared first on Security Boulevard.

A fake website impersonating Avast antivirus is tricking people into infecting their own computers.

The site looks legitimate, runs what appears to be a virus scan, and claims your system is full of threats. But the results are fake: when you’re prompted to “fix” the problem, the download you’re given is actually Venom Stealer—a type of malware designed to steal passwords, session cookies, and cryptocurrency wallet data.

This is a classic scare-and-fix scam: create panic, then offer a solution. In this case, the “solution” abuses the trusted Avast brand to deliver the attack.

A scan that finds exactly what the attacker wants you to see

The phishing page is a recreation of the Avast brand, complete with navigation bar, logo, and reassuring certification badges. Visitors are invited to run what appears to be a comprehensive virus scan. Once they click, the page stages a brief animation before delivering its predetermined verdict: three threats found, three threats removed, system protected. A scrolling console log names a specific detection—Trojan:Win32/Zbot.AA!dll—to lend the performance an air of specificity. The victim is then prompted to download the cure: a file called Avast_system_cleaner.exe.

This is the payload. And far from cleaning anything, it immediately begins stealing.

A Chrome service that is not Chrome

When the victim launches Avast_system_cleaner.exe, the binary—a 64-bit Windows PE executable roughly 2 MB in size—copies itself into a location designed to blend in with legitimate software: C:\Program Files\Google\Chrome\Application\v20svc.exe. The dropped file is byte-for-byte identical to the parent, sharing the same MD5 hash (0a32d6abea15f3bfe2a74763ba6c4ef5). It then launches the copy with the command-line flag --v20c, a meaningless argument whose sole purpose is to signal to the malware that it is running in its second-stage role.

The disguise is deliberate. A process named v20svc.exe sitting inside Chrome’s application directory looks, at a glance, like a legitimate browser service component. Anyone scanning their task manager would likely scroll past it without a second thought. This is a textbook example of masquerading: naming a malicious binary to match the conventions of trusted software so it escapes casual inspection.

A debug artifact baked into the binary confirms its lineage: the PDB path reads crypter_stub.pdb, indicating the executable was packed using a crypter, which is a tool designed to scramble a payload’s code so antivirus engines cannot recognise it from its signature alone. At the time of analysis, only 27% of engines on VirusTotal flagged the sample, meaning roughly three in four commercial antivirus products missed it entirely.

YARA rules matched the sample to the Venom Stealer malware family, a known descendant of the Quasar RAT framework that has been sold on underground forums since at least 2020. Venom Stealer is purpose-built for data theft: browser credentials, session cookies, cryptocurrency wallets, and credit card details stored in browsers.

Every cookie, every wallet, every saved password

Once running, the malware works through a checklist of high-value targets on the victim’s machine.

It starts with browsers. Behavioral analysis confirms the malware harvests saved credentials and session cookies. In the analysis environment, it was observed directly accessing Firefox’s cookie database at C:\Users\<USER>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\cookies.sqlite-shm. Process memory also contained fully-formed JSON structures with stolen cookie data from Microsoft Edge and Google Chrome, including active sessions for Netflix, YouTube, Reddit, Facebook, LinkedIn, AliExpress, Outlook, Adobe, and Google. Stolen session cookies give the attacker the ability to hijack authenticated browser sessions without needing the victim’s password, including sessions protected by two-factor authentication.

The malware also targets cryptocurrency wallets. Behavioral signatures confirm it searches for and attempts to steal locally-stored wallet data, and Venom Stealer is documented as targeting desktop wallet applications. For anyone holding crypto assets on a hot wallet, the implications are immediate.

Beyond credentials, the stealer captures a screenshot of the victim’s desktop, saved temporarily as C:\Users\<USER>\AppData\Local\Temp\screenshot_5sIczFxY95t2IQ5u.jpg, and writes a session tracking file to C:\Users\<USER>\AppData\Roaming\Microsoft\fd1cd7a3\sess. A small marker file is also dropped at C:\Users\Public\NTUSER.dat—a path chosen to mimic a legitimate Windows registry hive file and avoid suspicion.

Disguised as analytics, delivered over plain HTTP

All stolen data is exfiltrated to a single command-and-control domain: app-metrics-cdn[.]com, which resolved to 104.21.14.89 (a Cloudflare address) during analysis. The domain name is crafted to look like a benign analytics or content delivery service, the kind of traffic that might not raise alarm bells in a corporate proxy log.

The exfiltration follows a structured four-step sequence over unencrypted HTTP. First, a multipart form-data POST to /api/upload transmits the collected file—screenshots, wallet data, cookie databases—totalling around 140 KB. A second POST to /api/upload-json sends a structured JSON payload of approximately 29 KB containing parsed credentials and cookies. A confirmation POST to /api/upload-complete signals that the theft is finished. The malware then enters a heartbeat loop, periodically checking in at /api/listener/heartbeat to maintain contact with the operator’s infrastructure.

All of this traffic uses a generic Mozilla/5.0 user-agent string, another attempt to blend in with ordinary web browsing.

Syscalls, sleep loops, and debugger checks

Venom Stealer does not simply steal and leave. It takes significant steps to avoid being caught. The most notable evasion technique is the use of direct and indirect system calls, a method where the malware invokes Windows kernel functions directly rather than routing through the standard ntdll.dll library. Because most endpoint detection tools work by intercepting calls to that library, this technique effectively blinds them. This behaviour was flagged in both the parent and the dropped child process.

The malware also checks whether it is being debugged, queries CPU vendor and model information, reads the volume serial number of the system drive, creates guard pages in memory that can crash debuggers attempting to step through the code, and enumerates running processes. These are common techniques for detecting virtual machines and analysis environments. To frustrate automated analysis further, it incorporates sleep calls exceeding three minutes.

This is not a new trick

Impersonating security software to distribute malware is one of the oldest tricks in the book. A user who believes their system is infected is primed to act urgently, and a page that looks like a trusted antivirus vendor is exactly the kind of authority they will defer to. By staging a fake scan that “finds” threats and then offering a cure, the attacker exploits both fear and trust in a single interaction.

This is not an isolated tactic. In May 2025, DomainTools documented a separate campaign in which attackers built a convincing clone of Bitdefender’s website and used it to distribute Venom RAT alongside the StormKitty stealer. The playbook is nearly identical: impersonate a security brand, manufacture urgency, and deliver a Trojan dressed as protection. It suggests this is a repeatable template, not a one-off experiment.

What to do if you may have been affected

Only download security software from official vendor websites. Avast’s legitimate site is avast.com. Do not trust search engine results, ads, or links in unsolicited emails.

If you interacted with a site like this or downloaded the file, act quickly:

• Check if your system is infected. Look for the file v20svc.exe in C:\Program Files\Google\Chrome\Application\. If it exists, your system was likely compromised by this malware.
• Run a full system scan immediately. Use a trusted, up-to-date anti-malware tool (such as Malwarebytes) to detect and remove the infection. If the scan finds threats, follow the tool’s recommendations to quarantine or delete them.
• Change your password right away. Start with email, banking, and any important accounts. Assume anything saved in your browser has been exposed.
• Sign out of all active sessions. Log out of services like Google, Microsoft, Facebook, and Netflix. Stolen session cookies allow an attacker to bypass two-factor authentication entirely.
• Protect cryptocurrency funds. If you use a desktop cryptocurrency wallet, transfer your funds to a new wallet generated on a clean device as soon as possible.

Indicators of Compromise (IOCs)

File hashes

• SHA-256: ecbeaa13921dbad8028d29534c3878503f45a82a09cf27857fa4335bd1c9286d

Domains

• app-metrics-cdn[.]com

Network indicators

• 104.21.14.89

C2 URLs

• http://app-metrics-cdn[.]com/api/upload
• http://app-metrics-cdn[.]com/api/upload-json
• http://app-metrics-cdn[.]com/api/upload-complete
• http://app-metrics-cdn[.]com/api/listener/heartbeat

---

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

CyberProof researchers have detected a 10% surge in PXA Stealer attacks targeting financial institutions in Q1 2026. Learn…

Seventeen months after international law enforcement dismantled one of the world's most damaging infostealing malware networks, a second defendant has arrived in a U.S. federal courtroom — this time extradited from Armenia — as the prosecution of the RedLine infostealer operation continues to work through the criminal network that built and sustained it. Hambardzum Minasyan, an Armenian national, appeared in an Austin federal court after being extradited to the United States to face charges related to his alleged role in the RedLine infostealer scheme. The Justice Department's Office of International Affairs secured Minasyan's arrest and extradition on March 23, 2026, with significant assistance from Eurojust's ICHIP attorney adviser based at The Hague. Minasyan faces three counts: conspiracy to commit access device fraud, conspiracy to violate the Computer Fraud and Abuse Act, and conspiracy to commit money laundering. If convicted, he faces up to 10 years in prison on the access device fraud charge and up to 20 years each on the remaining two counts. An infostealer is malware designed to silently harvest credentials, browser cookies, saved passwords, financial data, and cryptocurrency wallet information from an infected device, then transmit that data to attackers — often in seconds, without any visible sign of compromise. The indictment alleges that Minasyan and his co-conspirators maintained digital infrastructure, including command-and-control servers and administrative panels, to deploy the malware and collected payments from affiliates using RedLine against victims. Minasyan specifically registered two virtual private servers and two internet domains to support the RedLine scheme, created repositories on an online file-sharing site to distribute RedLine to affiliates, and registered a cryptocurrency account in November 2021 to receive payments. RedLine operated on a Malware-as-a-Service model. It is a criminal franchise structure where the core developers build and maintain the malware platform, then license it to affiliates who run their own infection campaigns in exchange for a fee. Affiliates distributed RedLine to victims using malvertising, phishing emails, fraudulent software downloads, and malicious software sideloading, with various ruses — including COVID-19 and Windows update lures — used to trick victims into downloading the malware. RedLine and its derivative Meta infostealer could also enable cybercriminals to bypass multifactor authentication through the theft of authentication cookies and session tokens. Multifactor authentication is a security layer requiring users to verify their identity through a second method beyond a password; stealing session cookies allows attackers to impersonate an already-authenticated user and render that protection useless. The Lapsus$ threat group used RedLine to obtain passwords and cookies from an employee account at a major technology company and subsequently used that access to obtain and leak limited source code. RedLine also infected hundreds of systems belonging to U.S. Department of Defense personnel, and authorities have described its victim count in the millions globally. Minasyan's extradition represents the second defendant charged in connection with Operation Magnus, the joint international takedown announced in October 2024.

Read: Law Enforcement Puts a Damning Dent in RedLine and Meta Infostealer Operations

Operation Magnus — a Joint Cybercrime Action Taskforce operation supported by Europol — resulted in Dutch authorities seizing three servers running the malware, Belgian authorities seizing communication channels and Telegram accounts used by the operators, and the recovery of a database of thousands of RedLine and Meta clients. That client database gave investigators a roadmap for follow-on prosecutions that continues to generate results. The first defendant charged, Russian national Maxim Rudometov, was identified as a developer and administrator of RedLine and unsealed in the Western District of Texas in October 2024. Rudometov, believed to reside in Krasnodar, Russia, is not expected to face extradition given his location.

Read: U.S. Charges Man Behind RedLine Infostealer that Infected U.S. DoD Personnel Systems

Minasyan's extradition from Armenia, by contrast, demonstrates the value of maintaining extradition treaty relationships and Eurojust cooperation frameworks that can reach defendants outside of jurisdictions beyond U.S. reach. The investigation is a joint effort by the FBI Austin Cyber Task Force, which includes the Naval Criminal Investigative Service, IRS Criminal Investigation, the Department of Defense Office of Inspector General's Defense Criminal Investigative Service, and the Army Criminal Investigation Division. The case demonstrates a sustained prosecution strategy, where rather than treating Operation Magnus as a one-time disruption event, the DOJ has continued converting the intelligence gained from seized infrastructure and client databases into individual criminal referrals across multiple jurisdictions.

Unit 42 research explores how AI is currently used in malware, from superficial integrations to advanced decision-making, and its future impact.

The post Analyzing the Current State of AI Use in Malware appeared first on Unit 42.

The new infostealer campaign spreads Vidar 2.0 via fake game cheats on GitHub and Reddit, stealing crypto, login tokens, and files while targeting young gamers ignoring security warnings