Malware

NFT-001

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

The victim receives a private phishing message related to an NFT or financial opportunity. The message includes a link to a fake website and malicious app that promises an improved user experience

T1566.002Spearphishing LinkEvidence1

If a user clicks the hyperlink in the message, it directs him to a decoy website that mimics the original. There, the user is prompted to download the malicious “installer” which infects the victim’s machine with the Remcos RAT.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

After excluding the C:\ folder from Windows Defender, the following Powershell commands are de-obfuscated and executed

T1574Hijack Execution FlowEvidence1

It hijacks the default handler for the ms-settings protocol and sets it to execute a Powershell command that adds the C:\ folder to the Windows Defender exclusion list.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence1

The execution starts by performing a User Account Control (UAC) bypass. It hijacks the default handler for the ms-settings protocol and sets it to execute a Powershell command that adds the C:\ folder to the Windows Defender exclusion list.

Stealth

3 techniques

T1036MasqueradingEvidence1

The message includes a link to a fake website and malicious app that promises an improved user experience

T1070Indicator RemovalEvidence1

It hijacks the default handler for the ms-settings protocol and sets it to execute a Powershell command that adds the C:\ folder to the Windows Defender exclusion list.

T1574Hijack Execution FlowEvidence1

It hijacks the default handler for the ms-settings protocol and sets it to execute a Powershell command that adds the C:\ folder to the Windows Defender exclusion list.

Other

1 technique

T1562Impair DefensesEvidence1

The new downloader adds increased defense evasion abilities to this malware.

INDICATORS OF COMPROMISE

IOCs tracked for this family

45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

27 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

16 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

morphisecNews

Apr 18, 2025

NFT Malware Gets New Evasion Abilities

Crypto/NFT-themed malware campaign targeting users on Discord and forums with phishing messages that lure victims to fake sites and malicious installers. The infection chain delivers payloads including Remcos RAT, BitRAT, AsyncRAT, and Eternity Stealer to steal browsing data, credentials, wallet information, and enable surveillance/keylogging.

morphisecNews

Apr 18, 2025

SYK Crypter Distributing Malware Families Via Discord

Mentioned only as prior Discord-related threat research for comparison/background.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching45

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

NFT-001

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

The victim receives a private phishing message related to an NFT or financial opportunity. The message includes a link to a fake website and malicious app that promises an improved user experience

T1566.002Spearphishing LinkEvidence1

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

After excluding the C:\ folder from Windows Defender, the following Powershell commands are de-obfuscated and executed

T1574Hijack Execution FlowEvidence1

It hijacks the default handler for the ms-settings protocol and sets it to execute a Powershell command that adds the C:\ folder to the Windows Defender exclusion list.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence1

Stealth

3 techniques

T1036MasqueradingEvidence1

The message includes a link to a fake website and malicious app that promises an improved user experience

T1070Indicator RemovalEvidence1

It hijacks the default handler for the ms-settings protocol and sets it to execute a Powershell command that adds the C:\ folder to the Windows Defender exclusion list.

T1574Hijack Execution FlowEvidence1

It hijacks the default handler for the ms-settings protocol and sets it to execute a Powershell command that adds the C:\ folder to the Windows Defender exclusion list.

Other

1 technique

T1562Impair DefensesEvidence1

The new downloader adds increased defense evasion abilities to this malware.

INDICATORS OF COMPROMISE

IOCs tracked for this family

45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

27 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

16 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

morphisecNews

Apr 18, 2025

NFT Malware Gets New Evasion Abilities

morphisecNews

Apr 18, 2025

SYK Crypter Distributing Malware Families Via Discord

Mentioned only as prior Discord-related threat research for comparison/background.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching45

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.