Loading story…
Multiple reports highlight continued growth in commercially sold malware—particularly infostealers and remote-access tooling—lowering the barrier for credential theft and enterprise targeting. Fortinet-described activity shows a phishing-led Agent Tesla delivery chain using business-themed lures (e.g., purchase orders), compressed attachments, and obfuscated scripting (e.g., .jse) to execute largely in-memory, leveraging techniques such as process hollowing and anti-analysis to reduce on-disk artifacts and evade endpoint controls while stealing browser, email, and other credentials.
Separately, researchers described new or increasingly marketed “as-a-service” tools that expand attacker capability across both Windows and Android. Flashpoint detailed DarkCloud, a low-cost infostealer sold via Telegram/clearnet that targets a wide range of browsers and enterprise-adjacent applications (email clients, FTP tools, VPNs), and uses legacy components (e.g., MSVBVM60.DLL) to complicate modern detection. Certo reported Oblivion, an Android RAT sold via subscription that targets Android 8–16 and emphasizes automated permission bypass and hidden remote control (HVNC/VNC-like) functionality alongside SMS/2FA interception and device takeover features. BlackFog reported Steaelite, a Windows RAT marketed to enable double extortion by combining data theft and ransomware deployment workflows in a single web panel, with HVNC monitoring and an announced Android ransomware module in development. A separate 2025 retrospective from TG Soft’s C.R.A.M. reinforces that malspam-delivered password stealers remain prevalent, with Agent Tesla, FormBook, and Remcos among the most common families observed in email campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Gen Digital disclosed Torg Grabber as a newly identified malware-as-a-service credential stealer that evolved over roughly three months from Telegram-based exfiltration to an encrypted HTTPS REST API command-and-control model. The report described broad credential and wallet theft capabilities, a multi-stage delivery chain using fake cheats, cracked software, and ClickFix lures, and evidence of use by multiple operators tied to Russian-speaking cybercrime networks.
Fortinet researchers reported a phishing campaign using business-themed lures and a RAR-delivered .jse loader to fetch and decrypt multiple in-memory stages that ultimately run Agent Tesla. The campaign used PowerShell, process hollowing into aspnet_compiler.exe, anti-analysis checks, and SMTP-based data exfiltration to evade detection.
Certo identified Oblivion as a subscription-based Android RAT targeting Android 8 through 16, with a builder for droppers and fake apps. The malware was reported to support SMS interception, banking-notification theft, keylogging, file management, hidden VNC control, and permission-bypass techniques across multiple Android OEM skins.
Flashpoint reported that DarkCloud remained a significant initial-access threat in 2026 because of its low cost and broad theft capabilities across browsers, email clients, file transfer tools, and VPN applications. The analysis highlighted its VB6-based implementation, layered string encryption, and multiple exfiltration channels including SMTP, FTP, Telegram, and HTTP.
BlackFog reported that Steaelite automatically exfiltrates victim data immediately after connection and provides operators with capabilities including remote code execution, hidden RDP, ransomware deployment, Defender disabling, persistence, UAC bypass, and a crypto clipper. The report also noted the developer had announced an Android ransomware module as in development and published indicators of compromise.
A threat actor publicly advertised the Oblivion Android RAT on a hacking forum, sharing product details and a video demonstration. The seller claimed the malware had been tested in live environments for more than four months without behavioral detections before release.
Steaelite, a browser-managed remote access trojan built to combine data theft and ransomware deployment for double-extortion operations, was first observed on underground cybercrime networks in November 2025. It was marketed as an easy-to-use all-in-one platform that lowered the barrier for less-skilled extortion actors.
Kaspersky researchers reported on CrystalX RAT, a remote access trojan distributed under a malware-as-a-service model. The malware was described as combining spyware, credential-stealing, and prankware capabilities, indicating use for surveillance, data theft, and disruptive actions by multiple operators.
DarkCloud, a commercially available credential-stealing malware family later sold via Telegram and a clearnet storefront, was first observed in 2022. Flashpoint also noted code-level similarities to A310LoggerStealer/BluStealer, suggesting an earlier lineage or iteration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Multiple reports detail **social-engineering-driven malware delivery** that results in **remote access trojans (RATs)** and credential theft. Infoblox described observing an affiliate push-notification ad network after exploiting misconfigured DNS delegations (“**Sitting Ducks**”/lame name server delegation) to take over abandoned threat-actor domains, allowing collection of **~57M logs** over two weeks and visibility into widespread **scams and brand impersonation** delivered via push ads. Nextron Systems separately reported recurring **malvertising** chains where “free converter” tools (e.g., document/image converters) downloaded from ads on legitimate sites function as advertised while covertly installing **persistent RATs**, with common artifacts such as Windows **Mark-of-the-Web** (`ZoneId=3`) indicating internet origin. Other activity in the set reflects different initial-access lures but the same general outcome—RAT-style access and data theft. Fortinet analyzed a **phishing** campaign using a fake Vietnam shipping document: a Word attachment leads to an RTF stage that exploits an RTF-related vulnerability, then uses **VBScript/PowerShell** to load a **fileless .NET module**, ultimately downloading and injecting a **Remcos** variant (including process hollowing) to provide full remote control. Separately, reporting on North Korea’s **“Contagious Interview”** campaign described fake recruiter outreach (e.g., via LinkedIn) that tricks developers into opening malicious code repositories; execution can be triggered via a hidden **VS Code `tasks` configuration**, server-side logic hooks, or a malicious npm dependency to steal credentials/crypto wallets and establish persistence—this is thematically similar (social engineering leading to remote access) but is a distinct operation from the malvertising/push-ad and Remcos phishing activity.
Jun 29, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026