Loading story…
Threat actors have leveraged popular creative content platforms and multimedia files to distribute infostealer malware to unsuspecting users. In one case, attackers uploaded free 3D model files containing malicious Python scripts to the CGTrader marketplace for use with the open-source Blender software. If users had Blender's "Auto Run Python Scripts" feature enabled, simply opening the .blend file would execute the embedded script, which then connected to a remote server to download a malware loader, ultimately infecting the system with the StealC V2 infostealer. This attack highlights the risks associated with open-source tools that allow automation and the lack of security controls on user-generated content marketplaces.
In a separate but thematically similar incident, Bitdefender researchers discovered a torrent file for the movie "One Battle After Another" that was used to deliver the Agent Tesla malware. The attack chain began when users launched a shortcut file included in the torrent, which triggered a series of PowerShell scripts hidden within a subtitle file. These scripts extracted and executed additional payloads from other files in the torrent, ultimately running the Agent Tesla infostealer entirely in memory to evade detection. Both incidents demonstrate the increasing sophistication of malware delivery methods that exploit trusted creative and entertainment platforms, targeting users through seemingly legitimate files and leveraging features like script automation and file embedding.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Bitdefender researchers uncovered a malware campaign using a fake torrent for the Leonardo DiCaprio film 'One Battle After Another' to target Windows users. The attack hid malicious code in subtitle files, abused legitimate Windows tools for execution, and ultimately deployed the Agent Tesla RAT.
A threat actor distributed free Blender .blend model files on CGTrader containing embedded malicious Python scripts. When opened with Blender's Auto Run Python Scripts feature enabled, the files executed code that downloaded a loader via Cloudflare Workers and infected victims with the StealC V2 infostealer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian-linked threat actors have been distributing the StealC V2 infostealer by uploading weaponized Blender `.blend` files to popular 3D model marketplaces such as CGTrader. These malicious files exploit Blender’s feature that allows embedded Python scripts to run automatically if the 'Auto Run Python Scripts' option is enabled. Unsuspecting users who download and open these files trigger the execution of hidden scripts, which initiate a multi-stage attack chain involving the download of additional payloads, including PowerShell scripts and ZIP archives containing Python-based stealers. The campaign has been active for at least six months and has been linked to previous operations targeting gaming communities with similar tactics and infrastructure. Morphisec, a cybersecurity firm, successfully detected and blocked several instances of this campaign, providing technical analysis of the attack chain and infrastructure. The StealC V2 malware is capable of stealing credentials and data from over two dozen browsers, more than 15 desktop wallets, and a wide range of plugins and communication applications. This campaign marks the first public attribution of malicious Blender files to StealC and Russian threat actors, highlighting the evolving threat landscape for creative professionals and the risks associated with downloading third-party assets from online marketplaces.
Jun 29, 2026
Threat researchers reported two large malware distribution operations that relied on popular consumer lures rather than software exploits. One campaign used piracy sites offering movies, TV shows, books, and digital library content to push fake plugin or browser update prompts; the downloaded ZIP files abused DLL side-loading, ROP-based decryption, and reflective loading to install a modified `SilentCryptoMiner`, a watchdog, a RAT component, and CPU/GPU miners. The malware gated execution through DNS tunneling and date-generated command-and-control infrastructure, harvested host data, and established persistence with a fake `GoogleUpdateTaskMachineQC` service and repeated UAC elevation attempts, with implicated sites drawing roughly 40 million visits in a single month. A separate operation used `openew[.]app`, a fake ChatGPT download page impersonating OpenAI, to infect both Windows and macOS users with platform-specific malware. Windows visitors received a credential-stealing loader disguised as `Chat_GPT.exe`, built with Inno Setup and Electron and launching PowerShell activity that contacted `188.137.246.189`, while macOS users were served **Atomic Stealer (AMOS)** to steal passwords, browser data, Telegram sessions, and cryptocurrency wallet information. Researchers said the macOS payload also attempted to replace legitimate Ledger and Trezor applications with trojanized versions, underscoring a strong cryptocurrency theft motive and showing how attackers are exploiting AI-brand search traffic and piracy demand to scale malware infections.
Jun 29, 2026
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026