Loading story…
A sophisticated Windows packer known as pkr_mtsi has been actively used in large-scale malvertising and SEO poisoning campaigns to distribute multiple malware families. Attackers leverage fake download websites that mimic legitimate sources for popular software such as PuTTY, Rufus, and Microsoft Teams, tricking users into downloading trojanized installers. These campaigns do not involve supply chain compromises but instead rely on carefully crafted imitation sites that achieve high search engine rankings, increasing the likelihood of user infection.
The pkr_mtsi packer functions as a general-purpose loader, delivering a variety of malware including Oyster, Vidar, Vanguard Stealer, and Supper. Over the past eight months, researchers have observed significant evolution in the packer's obfuscation, anti-analysis, and evasive API resolution techniques, while its core structural and behavioral traits remain consistent enough for reliable detection. Security analysts have developed YARA rules and identified common antivirus detection patterns, though coverage remains inconsistent across products. The ongoing campaigns highlight the persistent threat posed by malvertising and the need for vigilant software sourcing practices.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News reported that pkr_mtsi was powering widespread malvertising campaigns and delivering several malware families through fake software download sites. The report emphasized inconsistent antivirus coverage and the packer's growing sophistication.
ReversingLabs released a researcher notebook detailing the pkr_mtsi packer's structure, behavior, and detection opportunities. The analysis highlighted consistent traits that still allow reliable identification despite the packer's evolution.
Over roughly the next eight months, the packer was updated with more advanced anti-analysis and obfuscation features, including memory allocation obfuscation, hashed API resolution, junk GDI calls, and modified UPX-packed intermediate payloads. The malware also appeared in both EXE and DLL forms, with DLL variants supporting persistence through regsvr32.exe and COM registration.
Beginning after its initial detection, pkr_mtsi was used in widespread SEO-poisoning and malvertising campaigns that impersonated popular software sites such as PuTTY, Rufus, and Microsoft Teams. These campaigns delivered multiple malware families including Oyster, Vidar, Vanguard Stealer, and Supper.
The Windows packer pkr_mtsi was first observed in April 2025. It appeared as a malware delivery tool used to distribute trojanized software installers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple active malware campaigns are using **social engineering** and **trojanized content** to compromise Windows systems, with lures ranging from pirated software downloads to business and shipping documents. AhnLab reported a “proxyjacking” operation attributed to **Larva-25012** that distributes fake installers (notably a trojanized *Notepad++* package) via cracked-software sites; the `Setup.zip` bundle includes a legitimate `Setup.exe` plus a malicious sideloaded DLL (`TextShaping.dll`) that decrypts and installs **DPLoader** for persistent command retrieval and follow-on payload delivery. The malware also tampers with defenses by changing Microsoft Defender settings (e.g., exclusions, reduced notifications, and blocking sample submission) to reduce detection while monetizing victims’ bandwidth through installed **proxyware**. Separately, FortiGuard Labs described a Russia-focused, multi-stage intrusion chain that abuses trusted services (**GitHub** and **Dropbox**) for payload hosting and weaponizes **Defendnot** (a Windows Security Center trust-model research tool) to disable **Microsoft Defender** before deploying a ransomware payload. Fortinet also documented phishing campaigns using weaponized shipping-themed Word documents to deliver **Remcos RAT**, including fileless execution behavior and exploitation of `CVE-2017-11882` (Microsoft Equation Editor) via remotely fetched templates. These campaigns reinforce the operational risk from user-driven execution paths (pirated installers and document lures), “living off the land” techniques, and defense evasion through both policy tampering and security tooling abuse.
Jun 29, 2026
Threat actors are increasingly leveraging fake websites and bogus software installers to distribute malware, employing advanced techniques such as AI-generated web pages and code-signed malicious applications. One campaign involves the use of the legitimate Syncro remote access tool, where attackers create their own signed builds and distribute them via mass-generated, AI-powered fake websites that closely mimic official application sites. These malicious sites are promoted through search engine optimization and phishing emails, often masquerading as trusted brands like antivirus or password management tools, to trick users into downloading malware-laden installers. Another ongoing global campaign, dubbed TamperedChef, uses counterfeit installers for popular software to deliver JavaScript-based remote access malware. The attackers utilize malvertising, SEO, and abused digital certificates from shell companies to increase the credibility of their malicious payloads. The infrastructure supporting these campaigns is described as industrialized, with operators regularly acquiring new code-signing certificates to evade detection. Both campaigns highlight the growing sophistication and scale of malvertising operations targeting users through deceptive download sites and installer packages.
Jun 29, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026