CoreSecThree

CoreSecThree is a cybercriminal malware-distribution framework associated with stealer delivery operations and linked to activity clusters involving web injects and fraudulent GitHub security-alert lures. It has been described as active since February 2022 and used consistently to propagate information-stealing malware. Reporting has associated CoreSecThree with campaigns tied to TA585, a threat actor assessed as unusually self-sufficient in controlling infrastructure, delivery, and installation across its attack chain. Operations linked to CoreSecThree have used phishing and web-based social-engineering chains to induce victims to execute malicious commands, including ClickFix-style prompts masquerading as verification or security steps. Associated delivery methods have included malicious JavaScript injected into legitimate websites to present fake CAPTCHA overlays, as well as abuse of GitHub notification workflows to send bogus security notices that redirect users to attacker-controlled delivery pages. These campaigns have been used to distribute commodity and subscription-based stealers and loaders, including MonsterV2, and earlier activity has also been linked to other stealer families. The framework is associated with credential and data theft-oriented malware operations rather than ransomware. Observed tradecraft includes initial access through phishing and spoofed notifications, reconnaissance and filtering checks during delivery, execution of staged scripts for payload deployment, and follow-on malware capable of remote control, payload retrieval, and theft of sensitive information. CoreSecThree is best understood as an enabling framework within financially motivated cybercrime activity centered on large-scale stealer malware propagation.