Multi-stage malware campaigns using fileless loaders, RATs, and evasion techniques

Multiple reports detail distinct, unrelated malware families and delivery chains rather than a single shared incident. One analysis covers NotOpenClaw, a Windows malware loader distributed via fake “OpenClaw” installers (including GitHub-hosted lures) and emphasizing VM/sandbox evasion; the sample analyzed was tagged with stealer-related indicators (e.g., VidarStealer) and was previously referenced in third-party reporting about fake OpenClaw installers deploying additional malware.

Separate research describes two different fileless/backdoor operations: HellsUchecker, a small native x64 backdoor delivered through a 10-stage chain beginning with a ClickFix fake Cloudflare CAPTCHA that tricks users into pasting an obfuscated Run command, using a LOLBin to fetch payloads over finger (TCP/79) and retrieving encrypted C2 configuration from a BNB Smart Chain smart contract ("EtherHiding"), culminating in an in-memory final payload using Hell’s Gate direct syscalls; and GhostWeaver, a fileless PowerShell RAT that selects persistence based on the installed AV product, uses TLS over TCP/25658, and relies on multiple DGA routines for delivery and C2. A separate brief reports the VOID#GEIST campaign delivering XWorm, AsyncRAT, and Xeno RAT via phishing, batch scripts from TryCloudflare domains, staged ZIP payloads, Python-based decryption/execution, and abuse of AppInstallerPythonRedirector.exe to facilitate additional RAT deployment.