Loading story…
Multiple sophisticated malware campaigns have been identified targeting organizations and individuals across various regions, utilizing advanced loader techniques and evasion tactics. Notable threats include AuraStealer, a malware-as-a-service infostealer distributed via social media scams and cracked software, capable of stealing data from a wide range of browsers and applications, and employing anti-analysis features such as geolocation checks and virtual machine detection. CloudEyE, another malware-as-a-service downloader and cryptor, has seen a dramatic increase in detections, serving as a delivery mechanism for other malware like Rescoms, Formbook, and Agent Tesla, and leveraging multi-stage delivery tactics to avoid detection. Additionally, a commodity loader has been used in targeted email campaigns against manufacturing and government sectors, employing weaponized documents, steganography, and multi-layered evasion pipelines to distribute remote access trojans and infostealers.
The Tuoni C2 malware framework was used in a stealthy attack against a major U.S. real estate firm, utilizing AI-generated code, steganography, and memory-only execution to evade detection and maintain long-term access for credential theft and potential ransomware deployment. These campaigns highlight a trend toward modular, evasive malware delivery systems that leverage commodity loaders, steganography, and malware-as-a-service models, enabling threat actors to efficiently compromise targets while minimizing forensic footprints. Security researchers emphasize the need for advanced detection and prevention strategies to counter these evolving threats, as traditional security layers are increasingly bypassed by modern malware techniques.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers published technical analysis of AuraStealer, a malware-as-a-service infostealer for Windows that steals data from browsers, applications, extensions, and cryptocurrency wallets. The report described its anti-analysis features, customizable theft options, underground promotion, and recent expansion from Russian-only to English language support.
Researchers identified a targeted email campaign against manufacturing and government organizations in Italy, Finland, and Saudi Arabia using a shared commodity loader. The attacks delivered RATs and information stealers through weaponized Office files, SVGs, and ZIP/LNK chains with steganography and fileless execution techniques.
Morphisec Threat Labs discovered a sophisticated intrusion targeting a major U.S. real estate company using the Tuoni command-and-control framework. The malware used AI-generated code, steganography, and memory-only execution to steal credentials, maintain persistence, and prepare for possible ransomware deployment while evading detection for weeks or months.
ESET Research observed more than 100,000 CloudEyE detections in the second half of 2025 and reported a thirtyfold increase in activity within six months. The malware was used to distribute payloads including Rescoms, Formbook, and Agent Tesla.
Businesses across Central and Eastern Europe were targeted in September and October 2025 by localized phishing emails delivering the CloudEyE malware-as-a-service downloader and cryptor. The messages often impersonated routine business communications and sometimes came from compromised legitimate business accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight active **Windows-focused malware** operations centered on credential theft and payload delivery. **Socelars** is described as a stealthy infostealer that prioritizes harvesting browser-stored session cookies and authentication artifacts (notably targeting *Facebook Ads Manager* sessions) to enable account takeover and fraud; it is reportedly distributed via fake websites posing as legitimate software (e.g., a PDF reader) and uses staged execution including system reconnaissance and a **UAC bypass via COM auto-elevation** before extracting browser session data for exfiltration. Separately, research details how established malware delivery ecosystems are evolving. Zscaler ThreatLabz reports **GuLoader (CloudEye)** increasingly abuses legitimate cloud services (e.g., *Google Drive* and *OneDrive*) to blend malicious downloads into normal traffic, while using polymorphism and control-flow obfuscation plus layered decryption to hinder analysis and deliver follow-on payloads such as RATs and stealers. Bitdefender reports a resurgence of **LummaStealer** despite prior law-enforcement disruption, attributing continued scale to social-engineering-heavy distribution (fake cracks/downloads and **fake CAPTCHA/“ClickFix”** lures) and the use of **CastleLoader** for modular, in-memory execution and obfuscated delivery; the report notes infrastructure overlap suggesting coordination or shared providers. A separate Unit 42 incident-response writeup on **Muddled Libra (Scattered Spider/UNC3944)** describes a distinct intrusion tradecraft involving unauthorized access to a *VMware vSphere* environment and a rogue VM used for reconnaissance, persistence, and interaction with enterprise infrastructure, and is not part of the infostealer/loader activity described in the other items.
Jun 29, 2026
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026
Multiple reports highlight continued growth in **commercially sold malware**—particularly infostealers and remote-access tooling—lowering the barrier for credential theft and enterprise targeting. Fortinet-described activity shows a **phishing-led Agent Tesla** delivery chain using business-themed lures (e.g., purchase orders), compressed attachments, and obfuscated scripting (e.g., `.jse`) to execute largely **in-memory**, leveraging techniques such as **process hollowing** and anti-analysis to reduce on-disk artifacts and evade endpoint controls while stealing browser, email, and other credentials. Separately, researchers described new or increasingly marketed “as-a-service” tools that expand attacker capability across both Windows and Android. Flashpoint detailed **DarkCloud**, a low-cost infostealer sold via Telegram/clearnet that targets a wide range of browsers and enterprise-adjacent applications (email clients, FTP tools, VPNs), and uses legacy components (e.g., `MSVBVM60.DLL`) to complicate modern detection. Certo reported **Oblivion**, an Android RAT sold via subscription that targets Android 8–16 and emphasizes automated permission bypass and **hidden remote control (HVNC/VNC-like)** functionality alongside SMS/2FA interception and device takeover features. BlackFog reported **Steaelite**, a Windows RAT marketed to enable **double extortion** by combining data theft and ransomware deployment workflows in a single web panel, with HVNC monitoring and an announced Android ransomware module in development. A separate 2025 retrospective from TG Soft’s C.R.A.M. reinforces that **malspam-delivered password stealers** remain prevalent, with **Agent Tesla**, FormBook, and Remcos among the most common families observed in email campaigns.
Jun 29, 2026