Trending Malware

CoGUI, also known as NX or FA, is a commercially distributed phishing-as-a-service kit used by Chinese-speaking cybercriminals to steal usernames, passwords, payment-card information, and other personal data. Observed since at least October 2024, it primarily targets Japanese-language users and organizations in Japan, with additional campaigns targeting the United States and other countries. It supplies ready-made messages and fraudulent websites impersonating retailers, financial institutions, government agencies, and trusted brands such as Amazon, PayPay, Rakuten, and Apple. High-volume email campaigns direct recipients to counterfeit login and payment portals, supporting account compromise and financial fraud. CoGUI employs geofencing, HTTP-header filtering, and browser or device fingerprinting to obstruct automated analysis and selectively expose phishing pages. Its profiling considers geographic location, browser language and version, operating-system platform, screen dimensions, and mobile-device status. Visitors who fail campaign-specific checks are redirected to legitimate websites or decoy destinations. Campaigns can selectively target mobile users or Windows desktop users. Microsoft tracks the developers associated with CoGUI, Haozi, and Iron Man System as Storm-2990. CoGUI has been sold through YAM Store, a criminal marketplace supplying compromised or fraudulently obtained cloud accounts and infrastructure. Related kits CoAceV and CoFish_Ws share common roots and overlapping affiliates. CoGUI-associated infrastructure was included in a court-authorized disruption conducted by Microsoft, Health-ISAC, and partners in 2026.

Haozi, also known as Phoenix, is a commercially distributed phishing-as-a-service kit used to steal usernames, passwords, payment-card information, and other sensitive data through impersonation of trusted organizations. It is sold through YAM Store, an illicit infrastructure marketplace and initial access broker tracked by Microsoft as Storm-3119. Microsoft tracks the Chinese-speaking developers and associated activity behind Haozi, CoGUI, and Iron Man System collectively as Storm-2990. The Storm-2990 kits support interactive phishing workflows that collect victim submissions through WebSocket connections and provide Telegram notifications to operators. These features allow operators to monitor victims in real time, request verification codes, and control subsequent phishing screens. The kits also support anti-analysis measures, including geographic filtering, fake CAPTCHA gates, and IP allowlists and blocklists. Operators distribute phishing lures through email and SMS, impersonating financial institutions, government agencies, delivery services, and other legitimate organizations. Haozi forms part of an ecosystem that supplies compromised or fraudulently obtained cloud infrastructure for large-scale phishing. Campaigns using this ecosystem have targeted consumers and organizations worldwide, including healthcare, financial services, wholesale distribution, and information technology organizations. Stolen credentials and financial information support account compromise and downstream financial fraud.

Mirai is a Linux-based IoT botnet malware family that compromises internet-connected routers, security cameras, digital video recorders, and other embedded devices, primarily to conduct distributed denial-of-service (DDoS) attacks. The original malware scans the internet for exposed devices and attempts authentication using a predefined set of common factory-default credentials. Compromised devices become botnet nodes that generate traffic to overwhelm targeted services. The original Mirai resides in volatile memory and does not survive a reboot, although devices remain vulnerable to reinfection unless their credentials and exposure are addressed. Mirai became widely known in 2016 and was used in the October 21 attack against DNS provider Dyn, disrupting access to major online services. Publication of its source code enabled numerous derivative botnets. Descendants have expanded recruitment beyond default-password guessing to exploitation of vulnerabilities in routers and other internet-facing systems. Mirai variants have been observed attempting to exploit vulnerabilities including CVE-2017-17215 in Huawei routers and CVE-2025-24016 in Wazuh, with multiarchitecture payloads supporting diverse embedded hardware. Mirai-derived infrastructure has also supported state-linked operations. Beijing-based Integrity Technology Group, associated with the China-linked threat actor Flax Typhoon, operated a Mirai-variant IoT botnet used to support reconnaissance and vulnerability scanning. That deployment illustrates the family's use beyond conventional DDoS operations without making espionage or data theft inherent capabilities of the original malware.

Iron Man is a subscription-based phishing-kit-as-a-service platform developed by Chinese-speaking cybercriminals. It supplies more than 2,300 ready-made impersonation templates, enabling operators to deploy brand-, industry-, and country-specific phishing websites, emails, and text messages. Its lures impersonate banks, retailers, healthcare providers, postal services, telecommunications companies, transportation authorities, and government agencies. Common themes include unpaid tolls, traffic penalties, delivery problems, tax obligations, and account verification, intended to induce disclosure of credentials, personal information, and payment-card data or fraudulent payments. Iron Man supports live, interactive credential harvesting, allowing operators to monitor victims and request one-time verification codes. Its product-selection subsystem includes phishing packages linked to payment-card capture. The associated phishing-kit ecosystem uses geofencing, fake CAPTCHA gates, and IP filtering to obstruct security analysis. Iron Man deployments require recurring communication with the vendor's licensing server. Microsoft collectively tracks Iron Man, CoGUI, and Haozi as Storm-2990. Iron Man was advertised through YAM Store, an illicit account and infrastructure marketplace tracked as Storm-3119, and increasingly displaced CoGUI by mid-2026. Its templates support worldwide targeting, including consumers and financial, healthcare, retail, and transportation organizations. Microsoft and Health-ISAC obtained a US court order to seize and redirect infrastructure supporting Iron Man, CoGUI, and YAM Store.

Hirudo is an Android banking trojan identified by ThreatFabric that combines financial credential theft with live remote control of infected phones. It steals banking passwords, payment PINs, device-unlock secrets, and SMS messages, and supports live screen streaming and access to front and rear cameras. Fraudulent checkout and credential prompts collect sensitive information, while fabricated payment-success messages conceal the deception. Its configured credential targets span Indonesia, China, India, Mexico, Morocco, and Thailand. Hirudo is delivered as a separate installation package by apparently functional shopping, adult-video, and short-drama applications. These droppers display legitimate-looking content and fake update prompts to induce installation. The payload requires its own Accessibility and notification permissions. One analyzed dropper temporarily blocks network traffic using a deliberately nonfunctional VPN during installation; this does not fully bypass Google Play Protect. A distinguishing feature is its replacement of legitimate banking applications with modified copies. Hirudo tracks 42 financial applications and has dedicated replacements for eight Indonesian banking applications belonging to seven banks. It detects targeted applications through Accessibility, checks their signing certificates, opens the original application's uninstaller, and downloads a replacement. Because the modified copies use a different signing key, the genuine applications must first be removed, and users can interrupt the replacement process. The replacements preserve almost all original application code while loading an embedded hooking engine based on YAHFA and Dobby. Activated by a local trigger created by Hirudo, the engine operates inside the banking application, substitutes genuine signing-certificate information, hides enabled Accessibility services, and removes screen-capture restrictions. It also manipulates key-attestation certificates using a publicly leaked keybox and relays Play Integrity requests through operator-controlled infrastructure. At least two associated attestation certificates were listed as compromised by Google. An exposed operator backend contained thousands of application-credential entries, device records, lock-screen history, and financial profiles. These records demonstrate organized collection of stolen information but do not establish a victim count.

Iron Man System is a commercially licensed phishing-as-a-service kit sold to criminal customers as a self-hosted, container-distributed package. Developed by Chinese-speaking cybercriminals, it belongs to the phishing-kit development cluster tracked by Microsoft as Storm-2990, alongside CoGUI and Haozi. It is distributed through YAM Store, an illicit marketplace and initial access broker tracked as Storm-3119 that also supplies compromised or fraudulently obtained cloud accounts and hosting resources. The kit provides a Go backend built with GoFrame, a bilingual Chinese-English administration panel, and more than 2,300 localized phishing templates covering at least 130 countries and regions. Templates impersonate postal and courier services, toll and traffic authorities, tax agencies, banks, telecommunications providers, retailers, healthcare providers, and other trusted organizations. Campaigns use email and SMS lures, including urgent payment and traffic-citation messages, to redirect victims to fraudulent websites. Customers of the broader ecosystem target consumers and organizations across healthcare, financial services, wholesale distribution, and information technology, including in Japan, the United States, Australia, and India. Iron Man System harvests login credentials, payment-card information, verification codes, and other victim-submitted data. WebSocket communications and Telegram notifications enable real-time monitoring of victim interactions and manual control of subsequent phishing screens. Its product-catalog functionality also captures product selections alongside payment information, supporting e-commerce fraud. Geofencing, fake CAPTCHA gates, and IP-based access controls hinder automated inspection and restrict access to intended audiences. Deployments depend on recurring authorization checks against shared vendor licensing infrastructure. Microsoft’s Digital Crimes Unit, law enforcement, and industry partners participated in a court-authorized disruption of the associated phishing ecosystem in 2026.

CoAceV is a credential- and payment-information phishing kit closely related to CoGUI and CoFish_Ws. The three kits share common roots and overlapping criminal affiliates, with similarities in targeting, decoy pages, and URL structures. CoAceV operates within a Chinese-speaking cybercriminal phishing ecosystem whose campaigns predominantly target Japanese organizations, with smaller numbers affecting the United States, Australia, and Italy. Across the three-kit ecosystem, financial services and healthcare are the most frequently affected sectors, followed by government, education, and manufacturing. The kit is distributed through high-volume phishing email campaigns that impersonate trusted Japanese and international brands. Messages use banking, credit-card, payment-account, retail, shipping, and transportation themes to direct victims to fraudulent login or payment portals intended to capture credentials and financial information. The related kits employ visitor filtering, including CAPTCHA gates, before exposing phishing pages. CoAceV uses conditional redirection and decoy pages to obstruct automated security analysis. In February 2026, it adopted a browser-condition-based redirection technique shortly after the same method appeared in CoGUI campaigns. CoAceV and CoGUI also shared decoy pages in Apple-themed campaigns during April 2026. Infrastructure supporting the broader ecosystem was targeted by a coordinated judicial and industry disruption involving Microsoft, Health-ISAC, and other partners.

CoFish_Ws is a credential- and payment-information phishing kit closely related to CoGUI and CoAceV. The three kits share common development roots and are used by overlapping criminal affiliates within a Chinese-speaking phishing and financial-fraud ecosystem. CoFish_Ws impersonates legitimate organizations through fraudulent login and payment pages, including observed JACCS-themed pages requesting account credentials and credit card information. Phishing emails direct recipients to these pages through filtering mechanisms, including CAPTCHA gates that impede automated inspection. CoFish_Ws and its related kits predominantly target Japan, with smaller campaign volumes affecting the United States, Australia, and Italy. Their campaigns use banking, credit card, payment-account, retail, shipping, and transportation themes. Across the three-kit campaign cluster, financial services and healthcare are the most frequently affected sectors, followed by government, education, and manufacturing. The kits exhibit overlapping targeting, decoy landing pages, and URL structures, and their operators use extensive, frequently rotated domain infrastructure.

SpyNote, also known as SpyMax, is an Android remote-access trojan and spyware family used for surveillance, credential theft, and financial fraud. It enables operators to monitor and control infected devices, enumerate files and device information, collect contacts and messages, monitor calls, record camera video and audio, capture screens, and track location. Stolen information is transmitted to attacker-controlled command-and-control infrastructure. SpyNote abuses Android Accessibility Services to capture keystrokes and on-screen activity, steal banking credentials and Google Authenticator codes, automate interface actions, install additional applications, and obstruct uninstallation. Variants harvest Google and Facebook credentials through fraudulent login overlays. Persistence mechanisms include foreground execution, while concealment, string obfuscation, commercial packing, and malformed application-package structures hinder detection and analysis. A cryptocurrency-focused variant can overlay legitimate wallet applications, substitute an attacker-controlled destination address, and automatically initiate transfers. The SpyNote.C variant expanded the family’s banking-focused capabilities and was commercialized as CypherRat. Public release of its source code in October 2022 contributed to increased detections and proliferation of customized variants. Distribution includes phishing websites, malicious applications shared through WhatsApp, fake browser installation pages, and applications impersonating banks, cryptocurrency wallets, popular services, or contact-tracing tools. SecuriDropper has delivered SpyNote using an installation method that bypasses Android 13 Restricted Settings, allowing the payload to request Accessibility access. SpyNote supports both criminal fraud and targeted espionage. Modified SpyNote applications have been associated with Confucius, and historical use has also been associated with OilRig, APT-C-37, and OilAlpha. An unidentified actor used SpyNote-generated payloads against high-value individuals in Southern Asia. In financial-fraud campaigns affecting Czechia, Slovakia, and Slovenia, attackers use live telephone social engineering to induce installation, then exploit SpyNote’s remote access and Accessibility permissions to silently install and activate WindRelay. SpyNote provides device takeover and facilitates additional fraud, while WindRelay performs the separate NFC payment-card relay function.

Anatsa, also known as TeaBot and Toddler, is an Android banking trojan identified by ThreatFabric in January 2021. It targets banking, investment, and cryptocurrency applications, combining credential theft with remote-access and semi-automated transfer capabilities to facilitate fraud directly on infected devices. Anatsa abuses Android Accessibility Services to inspect screen content, log keystrokes, identify interface elements, and interact with applications. It detects targeted financial applications and displays counterfeit login overlays supplied by its command-and-control infrastructure to capture credentials. Additional capabilities include SMS interception, theft of Google Authenticator codes, and exfiltration of contacts and device information. Its remote-control functionality lets operators observe the screen in real time, launch applications, perform clicks and gestures, and manipulate text fields. It also obstructs normal uninstallation and can interfere with device shutdown or reboot, complicating removal. Distribution campaigns use malicious or trojanized applications on Google Play, including PDF readers, document scanners, QR scanners, file managers, and cryptocurrency tools. These applications can provide genuine functionality while downloading a separate Anatsa payload, frequently disguised as a required update. Some campaigns initially publish benign applications and subsequently introduce malicious delivery functionality. Anatsa has also been distributed through parcel-themed smishing campaigns impersonating UPS. Delivery infrastructure can profile devices and selectively serve payloads according to regional or device criteria. Observed evasion techniques include analysis-environment checks, runtime code encryption, and malformed APK archives. Campaigns target financial-service customers internationally, including customers of Dutch banks.

XMRig is an open-source cryptocurrency miner used to mine Monero. Although legitimate mining software, it is widely deployed by threat actors for cryptojacking, consuming compromised systems' computing resources to generate cryptocurrency for attacker-controlled accounts. Unauthorized deployments affect Windows, Linux, and macOS systems, including enterprise servers, cloud workloads, containers, and internet-exposed AI infrastructure. Attackers install XMRig after exploiting vulnerable applications, exposed services, or insecure configurations. It is deployed alongside Kinsing and by PoeLLM in the Canto Incognito campaign. Other deployments follow exploitation of AhsayCBS backup servers, React Server Components and Next.js applications, Microsoft Exchange servers, and macOS Screen Sharing. Distribution also includes compromised software repositories and Docker images, and ClickFix lures on Steam forums that persuade users to execute administrative PowerShell commands disguised as troubleshooting fixes. These activities involve multiple operators rather than a single associated threat actor. Malicious deployments frequently rename XMRig to impersonate browsers or operating-system components and use external scripts, service wrappers, scheduled tasks, systemd services, shell startup configuration, or macOS LaunchDaemons to maintain execution. Supporting components can conceal mining by stopping it when Windows Task Manager opens, configure Microsoft Defender exclusions, or restart the miner after termination or reboot. ProxyShellMiner executes XMRig through browser process hollowing. Some Windows deployments use a vulnerable signed hardware-access driver to improve RandomX mining performance. These persistence, injection, and concealment behaviors belong to the surrounding attack tooling rather than being inherent malicious functions of the legitimate miner.

Midnight Mimosa is a firmware-embedded Android malware family that provides privileged payload loading and application management, primarily supporting advertising fraud. Identified by Bitdefender, it affects low-cost phones from multiple brands using MediaTek platforms, including counterfeit devices marketed under flagship model names. It has been observed on thousands of devices across more than 150 countries over approximately two years, with Mexico, France, and Italy leading observed detections. Counterfeit Samsung branding does not establish infection of genuine Samsung-manufactured devices. The persistent component masquerades as an Android system application, uses platform-signed system privileges, and can silently install or remove applications, grant permissions, and execute remotely supplied code. Its native component decrypts an embedded framework that downloads and loads additional modules. Encryption, misleading payload extensions, and repeated installation and removal of cover applications conceal its behavior. During payload installation, it temporarily disables Google Play Store and subsequently restores it; some variants also forge Google Play installation provenance. Midnight Mimosa deploys at least 32 disguised utility applications that use legitimate advertising SDKs to generate fraudulent impressions and automated clicks without genuine user engagement. Related advertising-fraud code also appears in 13 Google Play applications, which lack the firmware component's elevated privileges. A separate deployed payload implements a remotely controlled TCP proxy capable of relaying traffic through infected phones, although researchers did not observe traffic relaying during a fresh-node test. The malware also gathers device and installed-application information; observed sensitive-permission manipulation was not demonstrated to support data theft. The responsible operators and the firmware supply-chain insertion point remain unidentified. Ordinary application uninstallation cannot remove the persistent firmware component. Durable remediation requires trusted firmware replacement or vendor-level cleanup; disabling malicious components through Android Debug Bridge is another mitigation.

EvilTokens is an AI-enabled phishing-as-a-service platform targeting Microsoft 365 accounts through abuse of the OAuth 2.0 Device Authorization Grant. First observed in February 2026, it was developed and supported by the threat actor Microsoft tracks as Storm-2992 and marketed to cybercriminal subscribers through Telegram. Its campaigns compromised more than 12,000 mailboxes across over 10,000 organizations worldwide, including financial services, construction, real estate, healthcare, wholesale distribution, and education. The platform generates live Microsoft device codes and persuades victims to enter them into Microsoft's legitimate authentication portal. Victims complete normal authentication, potentially including multifactor authentication, but authorize an attacker-controlled client. Automated polling then retrieves access and refresh tokens without directly stealing the victim's password. Delivery uses business-themed phishing emails, document-sharing and signature requests, invoice lures, and PDF or HTML attachments. EvilTokens provides 44 phishing themes, landing pages, victim tracking, redirect logic, and AI-assisted campaign customization. Multi-stage redirects, fake verification checks, and legitimate cloud hosting help obscure phishing infrastructure and evade automated inspection. After compromise, operators use stolen tokens to access and exfiltrate email, send messages from trusted accounts, and perform Microsoft Graph reconnaissance. AI-assisted mailbox analysis summarizes and translates correspondence, maps organizational relationships, identifies payment approvers and financial discussions, and helps prepare targeted business email compromise and payment-fraud attempts. Operators may establish persistence through attacker-controlled device registration and Primary Refresh Tokens, while malicious inbox rules conceal activity. Password changes alone do not necessarily eliminate token-based access. In September 2026, Microsoft and partners conducted a court-authorized disruption that seized 50 EvilTokens websites and disabled approximately 150 additional associated domains.

PickleShell is a lightweight C#/.NET reverse shell for Windows used by Silent Lynx, whose activity overlaps with UAT-6275 and TAG-193. It provides interactive remote command execution by launching a hidden Windows command interpreter and relaying commands and output through its command-and-control connection. It supports SSL/TLS-encrypted communications and bypasses server certificate validation. An observed payload masqueraded as the Windows Distributed Transaction Coordinator service. PickleShell has been deployed through spearphishing-delivered RAR archives containing malicious shortcuts that launch hidden PowerShell and retrieve scripts and payloads hosted on GitHub. Later versions of this delivery chain place PickleShell in the per-user Windows Startup folder to establish persistence at user sign-in. In April 2026, Silent Lynx also delivered it through crafted RAR archives exploiting WinRAR vulnerability CVE-2025-8088. This exploit-assisted chain writes the payload into the Startup folder without requiring elevated privileges. PickleShell forms part of Silent Lynx’s reverse-shell toolkit for cyberespionage against government organizations across Central Asia and the wider Commonwealth of Independent States. The actor’s targeting includes institutions responsible for diplomacy, economic development, agriculture, environmental management, water resources, and energy-related policy.

Laplas is a lightweight C++ reverse-shell implant for Windows used by Silent Lynx, also tracked as UAT-6275 and TAG-193. It connects to an external command-and-control server and provides interactive command execution through the Windows command interpreter, using redirected pipes to exchange commands and output. Identified variants support TLS communications, check for an attached debugger, and use multistage XOR obfuscation. Its deployment is associated with cyberespionage campaigns against government organizations in Central Asia and the wider Commonwealth of Independent States, including institutions responsible for diplomacy, economic development, environmental management, and resource governance. Silent Lynx uses regionally tailored spearphishing and official-looking document lures to deliver malware. The Laplas name is also used for a Windows cryptocurrency clipper that replaces copied wallet addresses with attacker-controlled addresses. That clipper has been delivered by SmokeLoader and downloaded following Erbium Stealer execution. A relationship between the reverse-shell implant and the cryptocurrency clipper is not established; their capabilities and distribution chains should not be conflated.

Chvost is a lightweight Windows reverse-shell malware family used by Silent Lynx, also tracked as UAT-6275 and TAG-193, to provide interactive remote access and execute commands on compromised systems. It forms part of the actor’s cyberespionage toolset used against government organizations across Central Asia and the wider Commonwealth of Independent States, including institutions responsible for diplomacy, economic development, agriculture, environmental management, and resource governance. The earliest identified Chvost sample was compiled in June 2022. The family evolved from plaintext TCP communication to TLS communication using statically linked OpenSSL and employs XOR-based obfuscation. Analyzed variants make a single connection attempt and lack anti-debugging checks, distinguishing them from the related tooling used alongside them, particularly Laplas. Chvost has been deployed through a Turkmenistan-themed delivery chain using a PS2EXE-packaged PowerShell downloader. The downloader retrieves an archive containing the payload and a PDF decoy, then establishes persistence through a scheduled task configured to run hourly. Silent Lynx distributes malware through regionally tailored spearphishing messages, including messages sent from compromised government email accounts.

BADBOX is an Android-focused malware and botnet ecosystem that compromises consumer devices and monetizes their internet connectivity through residential proxy services. First identified in 2023, the original operation primarily affected devices shipped with firmware backdoors already installed. Compromised products include low-cost TV streaming boxes, smartphones, tablets, smart TVs, digital projectors, digital picture frames, and aftermarket vehicle infotainment systems. Proxy functionality routes third-party traffic through victims’ connections, allowing criminals to obtain access to residential networks without their owners’ consent. Following disruption of the original operation in 2024, BADBOX 2.0 emerged with more than one million compromised devices identified in 2025. Infection routes include malware installed before purchase and backdoored applications downloaded during device setup, including through unofficial application marketplaces. MoYu Group is one of the threat actors associated with the BADBOX ecosystem. A related campaign discovered in June 2026 abused the legitimate TWCore update application on DoFun Android automotive head units to install JarService and additional payloads. That campaign supported advertising fraud and deployed the zhima reverse-proxy module to recruit devices into a proxy botnet, demonstrating expansion beyond preinstalled firmware infections.

Kimwolf is an Android-focused botnet associated with the Aisuru group that primarily compromises inexpensive, non-certified Android TV and streaming boxes in residential networks. Affected devices also include smart TVs and tablets. Its infection population has been estimated at roughly two million devices worldwide, although changing residential addresses and intermittent device availability complicate precise counting. Shared distribution scripts, APK signing certificates, payload characteristics, and infrastructure link Kimwolf closely to Aisuru. Kimwolf supports distributed denial-of-service attacks, TCP and UDP proxy forwarding, reverse shells, remote command execution, and file reading and writing. Proxy-service commands dominate observed activity, enabling operators to exploit compromised residential bandwidth. Its DDoS implementation incorporates Mirai-derived command structures and multiple attack methods, and Kimwolf has participated in multi-terabit-per-second attacks. Operators use residential proxy infrastructure to reach internal devices, scan for exposed Android Debug Bridge services, and install malicious Android packages, allowing recruitment of devices behind home firewalls. The malware includes native ARM payloads compiled with the Android NDK and APK components that launch payloads at boot. Evasion and infrastructure-resilience mechanisms include packing, string obfuscation, process masquerading, encrypted command-and-control traffic, DNS over TLS, encoded server addresses, and Ethereum Name Service records used for EtherHiding. Command-and-control sessions use elliptic-curve signature verification. Coordinated international law-enforcement action disrupted Kimwolf infrastructure in March 2026, but subsequent activity demonstrated that the disruption did not eliminate the threat.

Shopora is an Android dropper disguised as a functional shopping application that delivers the Hirudo banking trojan. It presents real storefront content through a WebView, collects campaign-attribution data, retrieves campaign configuration, and checks whether the Hirudo payload is installed and has the required Accessibility and notification permissions. When the payload is absent, it presents a fake in-app update prompt to induce installation of a separate malicious application, which requires its own permissions. Distribution includes counterfeit Google Play-style landing pages promoting shopping applications. An analyzed shopping-dropper implementation establishes a deliberately nonfunctional VPN during payload installation, blocking IPv4 traffic to impede online security checks. This does not eliminate offline malware detection. Shopora also provides the shopping workflow over which Hirudo can display a fraudulent checkout, steal payment PINs, and return a fabricated payment-success result. The separately installed Hirudo payload supports credential theft, screen and camera surveillance, SMS collection, and remote device control. It also attempts to replace legitimate banking applications with modified copies that conceal tampering and undermine application security checks. Its replacement-app targeting includes eight Indonesian banking applications across seven banks, while configured financial credential targets extend to China, India, Mexico, Morocco, and Thailand. These banking and surveillance functions belong to Hirudo rather than the Shopora dropper itself.

1V1 X is an Android dropper application used to deliver the Hirudo banking trojan. It presents itself as an adult-content application and provides advertised functionality to make the lure appear legitimate. Its distribution includes a counterfeit Google Play-style installation page branded as 1v1 vip. The application belongs to a group of functional shopping and entertainment droppers that collect promotion-tracking information, retrieve campaign configuration, and check whether Hirudo is installed with the required permissions. When the payload is absent, the droppers present a fake in-app update prompt to induce installation of Hirudo as a separate application, which requires its own permissions. The delivered Hirudo payload steals financial credentials, payment PINs, device-unlock secrets, and SMS messages, and supports remote device control and screen and camera surveillance. Hirudo also replaces selected Indonesian banking applications with modified copies that undermine application security checks. These banking-theft and surveillance functions belong to the separately installed payload, rather than being established capabilities of 1V1 X itself.

KoiShort is an Android dropper application used to distribute Hirudo, a banking trojan with remote-access capabilities. It presents itself as a legitimate short-drama application and provides advertised entertainment functionality to support its lure. KoiShort has been associated with both short-drama and casino-themed distribution routes. The Hirudo dropper workflow retrieves campaign configuration, checks whether the payload is installed and has required permissions, and presents a fake in-app update prompt when installation is needed. Hirudo is delivered as a separate Android installation package and requires its own permissions; KoiShort serves as the delivery component rather than the banking payload itself. Once installed and authorized, Hirudo steals banking credentials, payment PINs, device-unlock secrets, and SMS messages, and supports remote device control, screen streaming, and camera access. It also attempts to replace legitimate banking applications with modified copies that undermine signature verification, Accessibility detection, screen-capture restrictions, and integrity checks. Dedicated replacements have been identified for eight Indonesian banking applications across seven banks, while Hirudo's configured credential targets extend to China, India, Mexico, Morocco, and Thailand.

ZoyaTV is an Android dropper application used to distribute Hirudo, a banking remote-access trojan. It presents functional short-drama content to appear legitimate while carrying Hirudo as a separate installation package. The dropper checks payload installation and permission status and displays a fake update prompt to induce installation and permission granting, including access to Android Accessibility services. Applications in this distribution scheme also collect promotion-tracking data and retrieve campaign configuration. The separately installed Hirudo payload supports credential theft, remote device control, screen and camera capture, and SMS collection. It can steal banking passwords, payment PINs, and device-unlock secrets, and replace legitimate banking applications with modified copies that undermine signature verification, Accessibility detection, screen-capture restrictions, and integrity checks. Dedicated replacements have been identified for eight Indonesian banking applications across seven banks, while Hirudo's configured credential targets also include China, India, Mexico, Morocco, and Thailand. These banking and surveillance capabilities belong to Hirudo rather than to the ZoyaTV dropper itself.

Agent Tesla is a Windows-targeting, .NET-based information stealer with remote-access capabilities, distributed commercially through malware-as-a-service arrangements. It steals saved credentials and other sensitive information from browsers, email clients, FTP applications, VPN clients, remote-access software, messaging applications, and Windows credential stores. It can also recover wireless-profile credentials, collect email contacts and system information, and monitor keyboard and clipboard activity. Functionality varies by configuration; some variants disable keylogging, screenshot capture, clipboard monitoring, and cookie collection. Stolen information is exfiltrated through SMTP, FTP, or attacker-controlled Telegram bots. Agent Tesla is primarily distributed through phishing and malicious spam, including targeted spearphishing. Common lures impersonate business proposals, invoices, purchase orders, price quotations, shipping communications, and payment notifications. Delivery uses malicious Office documents and archives containing executables disguised as business documents. Document-based campaigns have exploited CVE-2017-0199, CVE-2017-11882, and CVE-2018-0802, while crafted-archive campaigns have exploited the WinRAR vulnerability CVE-2023-38831. Multistage infection chains use obfuscated scripts, PowerShell, image-embedded payloads, and memory-loaded .NET components. Agent Tesla payloads can execute through process injection or process hollowing inside legitimate Windows utility processes. Agent Tesla employs obfuscation and anti-analysis checks to detect debuggers, security software, virtual machines, sandboxes, and hosting environments, and may terminate when these checks identify an analysis environment. It is used by multiple financially motivated operators, including TA558, OPERA1ER, Nigerian cybercriminals tracked under SilverTerrier, and the operator known as Fucosreal. Observed campaigns have targeted maritime businesses, manufacturing enterprises, government institutions, banks, healthcare-related organizations, and other commercial entities across multiple regions.