Loading malware…
ZAPIXDESK is a specialized information-stealing tool used to extract data from WhatsApp accounts on compromised systems. It has been deployed in UAC-0247 espionage operations targeting Ukrainian local government bodies and municipal healthcare institutions, including clinical hospitals and emergency medical services.
The tool was observed during attacks in March–April 2026 alongside AGINGFLY, SILENTLOOP, and CHROMELEVATOR. These operations used humanitarian-aid-themed phishing emails that directed victims to malicious archives, with Windows shortcut files initiating HTA-based execution chains. ZAPIXDESK served the specific role of WhatsApp data theft within the attackers’ broader intrusion toolkit; browser credential theft and remote-control functionality were provided by separate tools.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PhantomCaptcha (UAC-0244) [...] déployant AGINGFLY [...], SILENTLOOP, CHROMELEVATOR, ZAPiXDESK.
PhantomCaptcha (UAC-0244) [...] déployant AGINGFLY [...], SILENTLOOP, CHROMELEVATOR, ZAPiXDESK.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacks typically began with phishing emails posing as discussions about proposals for humanitarian aid. Victims were asked to follow a link that led to the download of a malicious archive file.
Victims were asked to follow a link that led to the download of a malicious archive file.
BouncyCastle.Cryptography.dll must be in the same directory of the ZAPiXDESK.ps1 file... It may also be necessary to enable set the execution policy to Unrestricted or Bypass in PowerShell to execute the script... run script: .\ZAPiXDESK.ps1
Open PowerShell on target computer (it will attempt to claim administrative rights).
a separate tool called ZAPIXDESK was used specifically to steal data from the WhatsApp messenger application.
First, it obtains the OfflineDeviceUniqueID... It generates the first decryption key to session.db based on staticKey protect by DPAPI-NG than recovers clientKey from WAL file... With clientKey, it is able to derives encryption key... where all other keys were stored and are recovered from WAL file. DbKeys are used to decrypt the others databases.
First, it obtains the OfflineDeviceUniqueID, indicating the method used (TPM, REGISTRY, etc...), used in keys derivations linked to the machine.
A script that extracts DBKeys and decrypts all SQLITE3 database files (including db and write-ahead-logfiles ). On completion a ZIP file containing all WhatsApp decrypted LocalState db's... The tool copies the WhatsApp localstate files (where SQLite3 DB files are located) to operate them
... або ж з месенджеру WhatsApp (із застосуванням програмного засобу ZAPIXDESK) ...
Also downloaded to the infected machine is a malware family dubbed AGINGFLY and a PowerShell script referred to as SILENTLOOP
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.