Loading story…
A sophisticated phishing campaign is targeting the Cardano community by distributing a fake "Eternl Desktop" application through convincing, professionally crafted emails. The emails, titled "Eternl Desktop Is Live – Secure Execution for Atrium & Diffusion Participants," reference legitimate Cardano ecosystem initiatives and promise enhanced security and staking features to lure high-conviction users. The installer, distributed via a suspicious domain, drops LogMeIn Resolve—a legitimate remote monitoring and management (RMM) tool—onto victims' systems, granting attackers persistent remote access while evading traditional security filters.
The campaign's use of trusted branding, ecosystem-specific incentives, and polished messaging increases its credibility and effectiveness. The installer lacks digital signature transparency and is not announced through official Eternl channels, further indicating its malicious nature. By abusing a legitimate RMM tool, attackers bypass many security controls, putting Cardano wallet holders at significant risk of system compromise and potential asset theft.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Security reporting identified suspicious domains and file hashes tied to the campaign and warned that the activity showed signs of supply-chain abuse and trojanized wallet distribution targeting cryptocurrency users.
Analysis of the fake Eternl Desktop MSI found that it silently installed LogMeIn Resolve (GoTo Resolve), a legitimate RMM tool, to give attackers persistent unattended access to victim systems and enable possible credential or wallet theft.
Attackers launched a phishing campaign aimed at the Cardano community using professionally branded emails that promoted a fake 'Eternl Desktop' wallet application and directed users to a newly registered download domain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcemalwr-analysis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Forescout disclosed **SeasonalInvite**, a phishing campaign that uses fake seasonal eCard invitations to trick Windows and macOS users into installing legitimate remote monitoring and management (RMM) software, giving attackers persistent remote access without deploying traditional malware. Active since at least January 2026, the operation uses themed lures tied to events such as tax season, Valentine’s Day, and Easter, then routes victims through a traffic distribution system to counterfeit eCard pages that deliver installers tailored to the target operating system. Researchers said the attackers abused commercially signed tools including **ConnectWise ScreenConnect**, **LogMeIn Resolve**, **Kaseya**, and **O&O Syspectr**, helping the activity blend in with trusted software and evade standard trust checks. On macOS, the campaign reportedly paired a signed Kaseya package with a separate configuration file that redirected enrollment to attacker-controlled infrastructure through an unattended deployment feature. Forescout also identified a broad support infrastructure of **959** eCard-themed domains and **2,658** traffic distribution gate pages, along with evidence that parts of the phishing kit and web pages were likely AI-generated.
Jul 16, 2026
Attackers ran a large-scale cryptocurrency theft campaign built around **ElectroRAT**, a custom Golang remote access trojan hidden inside trojanized apps branded as **Jamm**, **eTrade**, and **DaoPoker**. The malware was distributed through dedicated websites, fake company fronts, forum accounts, social media personas, and paid promotion, targeting users on **Windows, Linux, and macOS**. Researchers said the operation had been active since at least January 2020 and likely reached thousands of victims, based in part on roughly **6,500 unique visitors** to Pastebin pages used to retrieve command-and-control details. Once installed, ElectroRAT ran covertly in the background as **`mdworker`** and gave operators broad surveillance and theft capabilities, including keylogging, screenshot capture, file upload and download, and remote command execution. The campaign’s infrastructure also showed ties to **Amadey** and the **KPOT** stealer, suggesting overlap with established criminal tooling, while the custom malware itself reportedly evaded antivirus detection for nearly a year. The operation highlights how convincing crypto-themed brands and cross-platform Electron applications were used to lure investors into installing malware that enabled wallet compromise and broader system access.
Aug 15, 2026