Loading story…
Cybersecurity researchers have identified a new threat actor, TA585, which has been actively delivering the MonsterV2 malware through a series of sophisticated phishing campaigns. TA585 distinguishes itself by managing its entire attack chain, from infrastructure setup and email delivery to malware installation, without relying on third-party distribution services or initial access brokers. The group has been observed using U.S. Internal Revenue Service (IRS) themed phishing lures to entice victims into clicking malicious links. These links often direct users to PDFs that further redirect to web pages employing the ClickFix social engineering tactic, which prompts users to execute malicious commands via the Windows Run dialog or PowerShell terminal. The initial PowerShell command triggers a secondary script that ultimately deploys MonsterV2 on the victim's system. In later campaigns, TA585 shifted tactics to use malicious JavaScript injections on legitimate websites, presenting fake CAPTCHA overlays to initiate the infection process. This approach also leverages ClickFix to deliver the malware payload. MonsterV2, also known as Aurotun Stealer, is a remote access trojan (RAT), stealer, and loader, first advertised on criminal forums in February 2025. The malware is notable for its high price and limited user base, with TA585 being one of the few actors deploying it. MonsterV2 is designed to avoid infecting systems located in Commonwealth of Independent States (CIS) countries, demonstrating a level of geographic targeting. Prior to adopting MonsterV2, TA585 campaigns distributed other malware such as Lumma Stealer, indicating a shift in their preferred payloads. The group’s use of web injection and filtering checks adds complexity to their attack chains, making detection and mitigation more challenging. Researchers have highlighted TA585’s innovation in the constantly evolving cybercrime landscape, noting their deviation from the typical "gig economy" model of cybercrime by maintaining end-to-end control over their operations. The campaigns have evolved over time, with new delivery techniques and social engineering tactics being introduced to increase infection rates. The technical sophistication of TA585’s infrastructure and delivery methods underscores the growing threat posed by self-sufficient cybercriminal groups. Security teams are advised to monitor for indicators of compromise related to MonsterV2 and to educate users about phishing tactics involving IRS-themed lures and fake CAPTCHA overlays. The emergence of TA585 and its operational model signals a trend toward more autonomous and innovative threat actors in the cybercrime ecosystem. Ongoing research and intelligence sharing are critical to tracking the evolution of TA585 and mitigating the risks associated with MonsterV2 and similar malware families.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
On October 3, 2025, Proofpoint published research on newly named threat actor TA585, describing it as an unusually self-sufficient cybercriminal operation that controls most of its attack chain end-to-end and frequently deploys MonsterV2.
TA585 began using GitHub issue-tagging abuse to send victims legitimate GitHub notification emails containing links to actor-controlled sites. The lures were crafted to resemble security alerts and were used to deliver malware including Rhadamanthys through ClickFix-style mechanisms.
Proofpoint reported that TA585 initially delivered Lumma Stealer but changed to using MonsterV2 in May 2025 as a primary payload in its ClickFix campaigns.
In April 2025, TA585 used malicious JavaScript injected into legitimate websites to display fake CAPTCHA overlays that tricked visitors into running PowerShell commands, enabling malware delivery after filtering and verification checks.
During February and March 2025, researchers observed U.S. government-themed phishing campaigns using IRS and SBA lures that led victims to ClickFix-style pages and delivered MonsterV2. These campaigns were observed but not attributed to a tracked actor.
MonsterV2, a malware-as-a-service offering also known as Aurotun Stealer, was being sold on criminal forums as a RAT, stealer, and loader by at least February 2025.
PRODAFT reported that the CoreSecThree framework, later linked by Proofpoint to TA585 web-inject and fake GitHub alert activity, has been active since February 2022 and used to distribute stealer malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourcescworld.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The TA585 threat group has orchestrated a sophisticated cybercrime operation leveraging the MonsterV2 Malware-as-a-Service (MaaS) platform and advanced social engineering techniques, notably the ClickFix method. TA585 distinguishes itself by controlling the entire attack chain, from infrastructure hosting to phishing campaign execution and malware deployment, without relying on external brokers. Their primary payload, MonsterV2, is a subscription-based, multi-functional malware capable of data theft and system takeover, and is distributed through highly targeted phishing campaigns. The group employs advanced filtering and anti-bot systems to ensure only genuine victims are targeted, and has also been observed distributing other infostealers such as Lumma Stealer and Rhadamanthys. ClickFix attacks, which have rapidly become one of the most prevalent social engineering threats in 2025, exploit user trust by convincing victims to copy and paste malicious commands into their own systems, bypassing traditional security awareness training. These attacks are often disguised as verification steps, CAPTCHA checks, or even social media tutorials, and have been observed spreading through trusted platforms, including GitHub. A new variant, FileFix, further refines this approach by leveraging Windows File Explorer for stealthier execution. Security researchers have noted a dramatic increase in ClickFix-style attacks, with detections rising over 500% in six months and HTML/FakeCaptcha (ClickFix) ranking among the top malware detections in early 2025.
Jun 29, 2026
Proofpoint reported that **TA584**, a high-volume **initial access broker (IAB)** tracked since 2020, significantly increased operational tempo in 2025 and introduced multiple attack-chain changes, including expanded global targeting, adoption of **ClickFix** social engineering, and delivery of a newer malware family dubbed **Tsundere Bot**. Proofpoint assessed that TA584’s rapid campaign iteration and shifting infrastructure/lures reduce the effectiveness of static detections, and noted overlap with a group it tracks as **Storm-0900**. TA584’s prevalent infection chain uses phishing emails sent from **hundreds of compromised, aged accounts** and delivered via services such as **SendGrid** and **Amazon SES**, with per-target URLs, **geofencing/IP filtering**, and redirect chains that can involve third-party **traffic distribution systems (TDS)** like *Keitaro*. Victims who pass filtering are led through a CAPTCHA page to a ClickFix page that instructs them to run a **PowerShell** command, which retrieves an obfuscated script and loads **XWorm** or **Tsundere Bot** in memory; Proofpoint assessed with high confidence that **Tsundere Bot infections could lead to ransomware**, given its observed capabilities for information gathering, exfiltration, lateral movement, and payload delivery. Kaspersky previously documented Tsundere Bot and linked it to a Russian-speaking operator associated with **123 Stealer**, and Proofpoint’s reporting ties its use directly to TA584’s access-brokering activity.
Jun 29, 2026
Proofpoint reported that suspected China-linked cybercrime group **TA4922** has expanded beyond its traditional East Asia focus and is now targeting organizations in the **UK, Germany, Italy, South Africa**, and other regions with localized phishing campaigns. The actor has used lures tied to **tax filings, payroll, benefits, invoices, HR notices, and compliance requests** to trick recipients into opening attachments, clicking links, or continuing email conversations, with activity increasing from spring 2025 and intensifying in March and April 2026. The campaigns delivered credential phishing and malware including **`SilentRunLoader`**, **`Atlas RAT`**, **`RomulusLoader`**, and **`Winos4.0`/`ValleyRAT`**. Proofpoint said the group relies on **DLL sideloading**, anti-analysis techniques, process injection, and selective payload delivery, while also abusing legitimate remote-management and file-sharing tools such as **AnyDesk**, **SyncFuture**, **GoFile**, **LimeWire**, and **MediaFire** to blend into normal activity and maintain access. Researchers assessed the actor as primarily **financially motivated**, pursuing credential theft, fraud, data theft, persistence, and access resale, and said code artifacts in the Python-based **`SilentRunLoader`** suggest some malware development may have been assisted by **large language models**.
Aug 11, 2026