Loading story…
APT-Q-27, also tracked as GoldenEyeDog, is running a social-engineering campaign against Web3 customer support teams by sending fake screenshot links through live chat and support queues. Researchers at ZeroShadow said the activity came to light after 1inch identified repeated suspicious support requests from multiple accounts using rotating IP addresses and the same shortlink-based lure, marking a shift from the group’s earlier reliance on trojanized software and watering-hole attacks to direct engagement with frontline support staff.
The infection chain uses a multi-stage malware delivery process in which a .pif executable is disguised as an image, then pulls additional payloads from an AWS S3 bucket and abuses DLL sideloading with a legitimate YY platform binary to run malicious code in memory. The final implant establishes persistence with a misspelled Windows service and a registry startup key, disables User Account Control through three registry changes, and communicates with 37 hardcoded command-and-control servers over TCP port 15628, giving the attackers a persistent backdoor into targeted environments.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
ZeroShadow analyzed the campaign and reported that the fake screenshot lure delivered a disguised .pif executable, fetched additional payloads from an AWS S3 bucket, used DLL sideloading with a legitimate YY platform binary, and established persistence while communicating with 37 hardcoded C2 servers over TCP port 15628.
1inch observed multiple suspicious customer support requests from different accounts and rotating IP addresses that all used the same shortlink-based fake screenshot lure, indicating a coordinated intrusion attempt.
APT-Q-27, also known as GoldenEyeDog, began an active campaign targeting Web3 customer support teams through live-chat interactions, marking a shift from its earlier use of trojanized software and watering-hole sites to direct engagement with support personnel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple early-2026 campaigns highlight increasingly **low-noise initial access** and **living-off-the-land** execution on Windows endpoints. CyStack reported activity attributed to **APT-Q-27 (GoldenEyeDog)** targeting financial institutions via a corporate support workflow: a user clicked a malicious link delivered through a **Zendesk ticket**, leading to download of an executable masquerading as an image/`.pif` file (aided by Windows’ hidden-extension defaults). The malware was signed with a **revoked certificate** that still appeared trusted due to a valid timestamp, and its modular backdoor/C2 infrastructure overlapped with prior APT-Q-27 activity, enabling stealthy persistence and control without triggering common endpoint alerts. Separately, Securonix described the **Dead#Vax** multistage campaign using phishing links to **VHD files hosted on IPFS**, where mounting/opening the VHD triggers **Windows Script Files**, obfuscated batch, and **PowerShell** loaders to support encrypted data theft and conceal execution logic, culminating in **AsyncRAT** deployment for credential theft, surveillance, and follow-on intrusion. In another targeted operation, Zscaler ThreatLabz linked **Operation Neusploit** to **APT28**, exploiting **CVE-2026-21509** (Microsoft Office/365 **OLE** bypass) via crafted **RTF** documents to drop payloads including **MiniDoor** (Outlook-focused collection and mailbox manipulation, including exfiltration to attacker-controlled email accounts) and **PixyNetLoader** (reported to use steganography). A separate “ThreatsDay” bulletin is a multi-story roundup and does not provide additional, specific corroboration on these same campaigns beyond mentioning adjacent themes (e.g., AsyncRAT/C2) in a broader news digest.
Jun 29, 2026
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026
Researchers documented two financially motivated malware operations using multi-stage delivery chains built around JavaScript and **MSI** installers. One campaign linked to **QakBot** used search-engine pay-per-click malvertising and fake **TeamViewer** and **Zoom** installers, with redirect infrastructure including `acehphonnajaya.com`, `homepagego.com`, and `bobforlacitycouncil.com`, ultimately leading to an MSI payload hosted at `richtools.info` and `216.120.201.170`. Analysis of the MSI found a QakBot stager with a modified configuration-decoding and C2 parsing routine, including an added flag field in C2 entries, suggesting the operators were testing or expanding malvertising as a delivery method. Proofpoint separately tracked **TA866** in a campaign dubbed **Screentime**, targeting organizations in the United States and Germany through email attachments and URLs routed via the **404 TDS** traffic distribution system. Its infection chain also relied on a JavaScript downloader and MSI package, which installed a VBS downloader called **WasabiSeed** that maintained persistence and fetched additional payloads. TA866 distinguished itself by deploying a **Screenshotter** tool to capture victims’ desktops for manual triage before selectively delivering follow-on malware, including an AutoHotKey-based **AHK Bot** for Active Directory profiling and in-memory **Rhadamanthys Stealer**, highlighting a broader criminal trend of using staged MSI-based infections to qualify victims before deeper compromise.
Aug 15, 2026