Lorem Ipsum

Campaign infrastructure is consistently registered through NameCheap with Withheld-for-Privacy domain privacy service out of Iceland and weaponized within hours to days of registration

In October 2025, MSTIC publicly attributed and disrupted a Rapid Brigantine campaign distributing fake MSTeamsSetup.exe files hosted on Teams-themed malicious domains ... driven by SEO poisoning and malvertising.

MITRE ATT&CK Techniques ... T1588.001 (Obtain Capabilities: Malware)

MITRE ATT&CK Techniques ... T1588.005 (Obtain Capabilities: Exploits)

In the March 2026 iteration of the campaign, the operators relied on plainraw[.]com ... to serve gzip-compressed, hex-encoded PowerShell payloads under disposable /raw/<hex> URL paths embedded in the trojanized MSI installers.

MITRE ATT&CK Techniques ... T1608.001 (Stage Capabilities: Upload Malware)

MITRE ATT&CK Techniques ... T1608.002 (Stage Capabilities: Upload Tool)

MITRE ATT&CK Techniques ... T1608.004 (Drive-by Target)

The first phase, observed in March and April, relied on SEO-poisoned websites distributing trojanized Microsoft Teams MSI installers.

MITRE ATT&CK Techniques T1102.001 (Dead Drop Resolver) T1189 (Drive-by Compromise) T1204.004 (Malicious Copy and Paste)

MITRE ATT&CK Techniques ... T1195 (Supply Chain Compromise)

"The scheduled task uses /sc minute /mo 60 and runs immediately."

“[ClickFix] substitut[es] the legitimacy of a validly signed installer with... a user voluntarily executing the malicious command in their own terminal.”

A trojanized Teams installer "contains an intermediate PowerShell file" that decodes a GZIP-compressed final stage.

The detection table identifies "powershell.exe → cmd.exe /c" execution of "1.bat" with a signed executable argument.

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag

TerminalFix lures direct users to open a Windows Terminal window, where victims execute a PowerShell command.

The website displays an iframe, presenting the user with a fake pop up indicating that their browser is out of date. The iframe includes instructions on how to remediate, simply by opening up windows terminal ( wt.exe ) and pasting a command into the terminal.

Each ZIP contains "a clean signed Microsoft executable, a trojanized DLL that the executable loads, and a .bat file."

"The scheduled task uses /sc minute /mo 60 and runs immediately."

"Script 1.bat writes an HKCU Run registry value and creates a scheduled task for persistence."

"The scheduled task uses /sc minute /mo 60 and runs immediately."

The loader "relaunches a second copy of the sideload executable and injects itself into it, after which the original process exits."

"Script 1.bat writes an HKCU Run registry value and creates a scheduled task for persistence."

Lorem Ipsum uses "word-based shellcode encoding," while Axolotl's decrypted shellcode uses "a distinct stack-junk obfuscator."

The image files contain encoded data that the malware extracts and decodes to facilitate C2 communications.

Axolotl's ciphertext "is appended after the PNG IEND chunk inside a named PNG resource." Lorem Ipsum carries malicious content in an added ".cpoc section."

Auto-run entries masquerad[e] as legitimate Microsoft or software-update components.

The loader "relaunches a second copy of the sideload executable and injects itself into it, after which the original process exits."

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag

Lorem Ipsum's decoded blob "jumps over an embedded decoy JPEG and XORs the remaining content in 8-byte units."

The MSI file contains a custom action that executes the PowerShell loader component silently by incorporating the -WindowStyle Hidden flag, concealing it from the end user

Each ZIP contains "a clean signed Microsoft executable, a trojanized DLL that the executable loads, and a .bat file."

The second PowerShell code is responsible for decoding another Base64-encoded payload embedded within itself, decompress it using gzip, and reflectively loads it directly into memory for execution, ensuring it is never written to disk.

Next, the backdoor gathers information about the impacted host, storing the information in JSON.

The loader sends "a POST request to /api/init/ with Content-Type: image/jpeg and an embedded decoy JPEG as the body" and then polls every five seconds.

Lorem Ipsum Loader issues an HTTP request to an attacker-controlled profile hosted on the legitimate Letsdiskuss platform... to retrieve the current set of C2 servers.

A public forum profile's about field "carries a C2 list framed by -=( and )=- and encoded using a dictionary."

Each infection beacons to three redundant Cloudflare-fronted C2 domains using the same per-victim UUID, complicating takedown and rendering IP-based blocking ineffective.

The hunting table identifies "powershell.exe creating libgcc_s_seh-1.dll and libwinpthread-1.dll beside an unsigned DLL" under a public user directory.