Loading malware…
RMMProject is a DLL-based remote access trojan delivered by the custom Potemkin loader in a ClickFix-driven intrusion reported by Huntress in May/June 2026. It was loaded reflectively in memory after Potemkin used a deterministic DGA and custom communications to locate command-and-control infrastructure; the live C2 domain observed for Potemkin/RMMProject was anus-staylard[.]xyz. The malware is described as a 4.4 MB x64, Lua-scriptable DLL embedding LuaJIT and exposing native modules for HTTP, JSON, SQLite, Windows registry access, ASN.1 parsing, and filesystem enumeration.
RMMProject reportedly implements 15 task types, including browser password and credential theft, cookie theft from Chrome, Firefox, and Edge, screenshot capture, hidden-desktop remote control, process execution, process injection, Lua script execution, and runtime module loading. It compresses stolen cookie data with zlib before exfiltration to C2. A notable capability is bypassing Chrome App-Bound Encryption: RMMProject injects an embedded helper DLL into a spawned Chrome or Edge process and uses Chrome's IElevator COM interface to decrypt protected keys. The helper DLL was reported with SHA-256 cd4e5e2c65b1660470d3446539ee68adf5faeece3eaeb46583623be9911ee145. Huntress also identified a hidden-desktop remote control component referred to as RTSC, which creates an invisible Windows desktop and launches Chrome or Edge on it for attacker interaction.
In the documented intrusion, initial access came from a ClickFix social-engineering lure on a compromised website that tricked a user into executing a malicious Run dialog command. That chain abused pcalua.exe to proxy mshta.exe, fetched an HTA from cl.distritovagas[.]com, downloaded inst24.msi from sonra.eutialyson[.]com, and installed Potemkin, which then delivered RMMProject entirely in memory. The intrusion later involved hands-on-keyboard activity, lateral movement, Defender evasion, and deployment of EtherRAT to more than 11 hosts. High-confidence indicators directly associated with RMMProject in the reporting include the C2 domain anus-staylard[.]xyz, the recovered follow-on DLL avast_update.bin with SHA-256 3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce, and the helper DLL hash cd4e5e2c65b1660470d3446539ee68adf5faeece3eaeb46583623be9911ee145.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
ClickFix is a social engineering trick that presents users with a fake troubleshooting instruction on a compromised website. The prompt tells the user to press Win+R, paste a command into the Windows Run dialog, and hit Enter.
RMMProject, a 4.4 MB DLL with 15 task types covering browser credential theft, cookie stealing across Chrome, Firefox, and Edge, a hidden remote desktop module, and process injection.
creates a remote thread ( CreateRemoteThread ) that calls LoadLibraryW with that path - the classic DLL injection technique
RMMProject, a 4.4 MB DLL with 15 task types covering browser credential theft, cookie stealing across Chrome, Firefox, and Edge, a hidden remote desktop module, and process injection.
creates a remote thread ( CreateRemoteThread ) that calls LoadLibraryW with that path - the classic DLL injection technique
Once connected, its only job is to fetch and reflectively load RMMProject, a 4.4 MB DLL...
RMMProject... with browser credential theft
RMMProject, a 4.4 MB DLL with 15 task types covering browser credential theft, cookie stealing across Chrome, Firefox, and Edge...
RMMProject, a 4.4 MB DLL with 15 task types covering browser credential theft, cookie stealing across Chrome, Firefox, and Edge...
The most noticeable capability in the DLL targets browser credentials and cookies across Chrome, Firefox, and Edge.
Task 1008 provides a simpler screenshot capability... the DLL captures frames using GDI+ functions
For each candidate domain, Potemkin sends an HTTP GET request to a fixed URL path... EtherRAT enters an endless polling loop. Each request goes to a freshly randomized URL
That script downloaded and installed an MSI package in the background with no visible indication to the user. Separately, the attacker deployed EtherRAT... Five hours later, the attacker dropped EtherRAT and set up a Cloudflare tunnel using a renamed copy of cloudflared.
The custom "Potemkin" loader used a deterministic DGA and custom cipher to deploy RMMProject. RMMProject RAT bypassed Chrome's App-Bound Encryption and embedded a LuaJIT scripting engine. The threat actors deployed EtherRAT...
Potemkin doesn't have a hardcoded C2 address... every time it needs to talk to its operator, it generates a list of candidate domain names
Potemkin doesn't have a hardcoded C2 address... This pattern is known as a Domain Generation Algorithm, or DGA... RMMProject also has its own embedded copy of the DGA.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.