Loading story…
Malware activity surged in Q3 2025, with the Center for Internet Security (CIS) reporting a 38% increase in notifications compared to the previous quarter. SocGholish remained the most prevalent malware, accounting for 26% of detections, and was often used to deliver additional payloads such as NetSupport and AsyncRAT. The quarter also saw the re-emergence of Gh0st, Lumma Stealer, and TeleGrab, as well as the debut of Jinupd, a downloader distributed via phishing and compromised websites. Lumma Stealer, notable for its infostealing and evasion capabilities, returned after law enforcement action against its infrastructure. Infection vectors tracked included dropped malware, malspam, and malvertising.
Separately, eSentire identified a November 2025 campaign leveraging ClickFix as an initial access vector to deploy Amatera Stealer and NetSupport RAT. Amatera Stealer, a rebranded version of ACR (AcridRain) Stealer, is capable of exfiltrating data from crypto-wallets, browsers, and messaging apps, and uses advanced evasion techniques to bypass security products. The campaign highlights the continued evolution and rebranding of stealer malware, as well as the persistent use of remote access tools like NetSupport in active threat campaigns.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
CIS published its Top 10 Malware Q3 2025 report, detailing leading malware families, infection vectors, and defensive coverage claims. The report also included indicators of compromise such as domains and SHA256 hashes to support detection and prevention efforts.
eSentire published research on the EVALUSION campaign, describing delivery of Amatera Stealer and NetSupport RAT. The reference indicates a newly documented campaign and associated technical findings, though no earlier event date is provided in the source excerpt.
During Q3 2025, MS-ISAC monitoring services recorded a 38% increase in malware notifications compared with the previous quarter. SocGholish accounted for 26% of detections and continued to serve as a common JavaScript downloader leading to follow-on payloads such as NetSupport and AsyncRAT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 116 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity agencies and researchers reported a surge in sophisticated cybercrime operations and malware campaigns in December 2025. Notable law enforcement actions included the takedown of major cybercriminal forums such as Cracked and Nulled, and the disruption of ransomware networks like Phobos/8Base, as highlighted in SOCRadar's review of top law enforcement operations. Concurrently, threat intelligence sources documented a rise in ransomware attacks, with LockBit 5.0 targeting 25 companies globally, and agencies intensifying pressure on pro-Russian hacktivist groups. The month also saw a significant malware incident in New Zealand, where the national cyber security agency warned 26,000 citizens about infections by Lumma Stealer, a credential-harvesting malware. Technical research revealed the continued evolution of information-stealing malware, such as Stealc and Phantom Stealer, which leverage new delivery methods including Discord-hosted payloads and fake software updates. The Mirai botnet family demonstrated renewed activity, with new variants like Broadside and Jackskid exploiting IoT vulnerabilities and targeting sectors such as maritime logistics. Reports also underscored the growing threat of browser-based attacks, with critical vulnerabilities being disclosed throughout the year, and the increasing use of social engineering tactics to bypass security controls. These developments reflect a rapidly shifting threat landscape, with attackers adopting advanced techniques and law enforcement responding with coordinated global operations.
Jun 29, 2026
Multiple cybersecurity reports highlight a surge in both ransomware and infostealer malware activity targeting organizations worldwide in late 2025. Notably, Qilin ransomware targeted a South Korean semiconductor back-end firm and a private equity firm, while data from a South Korean online ticketing platform was sold on dark web forums. The French interior ministry also faced a data breach, with claims surfacing on BreachForums and a suspect subsequently arrested. These incidents underscore the persistent threat posed by ransomware groups, with attacks affecting critical infrastructure sectors such as manufacturing, healthcare, and finance. The November 2025 threat trend report details the prevalence of major ransomware groups like Clop, Akira, and Qilin, and provides statistics on affected industries and regions. In parallel, infostealer malware campaigns have intensified, with Phantom Stealer version 3.5 emerging as a sophisticated threat capable of extracting sensitive data such as passwords, browser cookies, and cryptocurrency wallet information. This malware often masquerades as legitimate software installers, employing advanced evasion and process injection techniques to avoid detection. The November 2025 Infostealer Trend Report notes that infostealers like ACRStealer, LummaC2, and Rhadamanthys are frequently distributed via cracked software and SEO poisoning. Additionally, phishing campaigns using purchase order-themed PDFs are being used to harvest business credentials and system information, which are then exfiltrated to attackers via Telegram for further exploitation or sale.
Jun 29, 2026
Multiple reports highlight continued growth in **commercially sold malware**—particularly infostealers and remote-access tooling—lowering the barrier for credential theft and enterprise targeting. Fortinet-described activity shows a **phishing-led Agent Tesla** delivery chain using business-themed lures (e.g., purchase orders), compressed attachments, and obfuscated scripting (e.g., `.jse`) to execute largely **in-memory**, leveraging techniques such as **process hollowing** and anti-analysis to reduce on-disk artifacts and evade endpoint controls while stealing browser, email, and other credentials. Separately, researchers described new or increasingly marketed “as-a-service” tools that expand attacker capability across both Windows and Android. Flashpoint detailed **DarkCloud**, a low-cost infostealer sold via Telegram/clearnet that targets a wide range of browsers and enterprise-adjacent applications (email clients, FTP tools, VPNs), and uses legacy components (e.g., `MSVBVM60.DLL`) to complicate modern detection. Certo reported **Oblivion**, an Android RAT sold via subscription that targets Android 8–16 and emphasizes automated permission bypass and **hidden remote control (HVNC/VNC-like)** functionality alongside SMS/2FA interception and device takeover features. BlackFog reported **Steaelite**, a Windows RAT marketed to enable **double extortion** by combining data theft and ransomware deployment workflows in a single web panel, with HVNC monitoring and an announced Android ransomware module in development. A separate 2025 retrospective from TG Soft’s C.R.A.M. reinforces that **malspam-delivered password stealers** remain prevalent, with **Agent Tesla**, FormBook, and Remcos among the most common families observed in email campaigns.
Jun 29, 2026