Loading story…
Multiple cybersecurity incidents have been reported involving the distribution of malware through the abuse of legitimate software and remote management tools. Attackers have exploited platforms such as LogMeIn Resolve, PDQ Connect, and the open-source SteamCleaner utility by disguising malware as legitimate installers or updates. In one case, users were tricked into downloading a malicious version of LogMeIn Resolve or PDQ Connect from websites mimicking legitimate software download pages, resulting in the installation of data-exfiltrating malware. Another campaign involved a backdoor malware signed with a valid certificate and disguised as the SteamCleaner tool, distributed via GitHub repositories and websites offering illegal software. These attacks highlight the increasing sophistication of threat actors in leveraging trusted tools to bypass security controls and gain persistent access to victim systems.
The use of legitimate signatures and remote management tools allows attackers to evade traditional security products, as these tools are often whitelisted or considered benign in enterprise environments. Security researchers emphasize the need for enhanced monitoring of remote access tool usage, validation of software sources, and the implementation of behavioral detection mechanisms to identify abnormal activity associated with these tools. The campaigns demonstrate the importance of user awareness and the risks associated with downloading software from unofficial sources, as well as the necessity for organizations to maintain strict controls over the installation and execution of remote management utilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
ASEC published a separate report describing a case of malware distribution exploiting LogMeIn and PDQ Connect. No further details were provided in the reference content beyond the existence of the reported abuse case.
On November 9, 2025, ASEC disclosed technical details of the campaign, including anti-sandbox checks, PowerShell-based installation of Node.js, persistence via Windows Task Scheduler, and C2 beaconing. ASEC also warned the framework could be used to deploy additional malware such as proxyware.
ASEC observed a campaign distributing a modified SteamCleaner installer through a fake illegal-software download site that redirected victims to GitHub repositories hosting the malware. The installer was signed with a valid certificate and installed a backdoor-like capability for remote command execution.
The open-source SteamCleaner project that attackers later abused had not been updated since September 2018, establishing the baseline for the trojanized version. Attackers subsequently modified this older source code for malicious distribution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 40 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly leveraging legitimate IT tools and browser features to gain unauthorized access to victims' systems and steal credentials. Recent campaigns have exploited Remote Monitoring and Management (RMM) software such as LogMeIn Resolve (GoToResolve) and PDQ Connect, tricking users into installing these trusted applications under false pretenses. Once installed, these tools provide attackers with full remote access, often bypassing traditional security controls due to their legitimate nature. Attackers distribute these installers through convincing phishing emails and fake websites that mimic popular utility download pages, using legitimate domains like Dropbox to evade detection. The attackers pre-configure the RMM tools with their own identifiers, allowing seamless control over compromised systems. In parallel, social engineering attacks are evolving to exploit browser features and cloned websites. The ClickFix attack, for example, uses fake ChatGPT Atlas browser installers distributed via cloned sites and sponsored search results to deliver password-stealing malware. Similarly, the Matrix Push C2 platform abuses browser push notifications as a fileless attack vector, tricking users into enabling notifications that deliver fake system alerts and redirect to malicious sites. These techniques rely on the inherent trust users place in familiar brands and browser features, making them highly effective at bypassing both technical and human defenses.
Jun 29, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Threat actors are increasingly leveraging legitimate remote access tools, such as PuTTY and various remote monitoring and management (RMM) platforms, to facilitate lateral movement, data exfiltration, and persistent access within compromised networks. Attackers exploit the "living off the land" nature of these tools, blending their malicious activities with normal administrative operations to evade detection. In the case of PuTTY, adversaries use binaries like `plink.exe` and `pscp.exe` to move laterally and exfiltrate sensitive data, often leaving behind subtle forensic traces such as SSH host keys in the Windows registry. These artifacts can be crucial for investigators to reconstruct attacker activity, even after extensive log and artifact cleanup by the attackers. Similarly, security researchers have observed a surge in incidents where multiple RMM tools are abused in attack chains. Threat actors compromise or install RMM platforms like ScreenConnect, TeamViewer, Atera, NinjaRMM, and GoTo Resolve to maintain long-term access and persistence. Attackers often use phishing lures to trick victims into installing rogue RMM software, and may deploy several RMM tools in succession to ensure continued access even if one is detected and removed. These tactics highlight the ongoing challenge for defenders in distinguishing between legitimate and malicious use of remote access utilities, underscoring the need for robust monitoring and baselining of such tools within enterprise environments.
Jun 29, 2026