Loading story…
Security researchers warned that corporate users are facing sustained phishing activity that relies heavily on social engineering, including emails impersonating CEOs and executives and messages posing as copyright complaints, business proposals, recruiting outreach, and AI video tool offers. In the executive-impersonation cases, attackers used public webmail services such as Gmail and Hotmail to contact representative and recruiting inboxes, pressured recipients to reply or share messenger chat-room QR codes, and appeared to be conducting reconnaissance for follow-on compromise rather than delivering malware immediately.
A separate long-running campaign tracked as PyChain was attributed to a Vietnam-linked threat actor dubbed LoneNone, which used ZIP archives and disguised executables to infect victims through multi-stage malware delivery. Recent samples abused a fake PDF executable built from ADNotificationManager.exe for DLL sideloading, then fetched an encrypted archive containing Python runtime components and obfuscated scripts that stole browser credentials, cookies, system information, and cryptocurrency wallet data. Researchers said the actor repeatedly changed delivery infrastructure and lures, using services and channels including GitHub, Dropbox, Telegram bots, paste sites, URL shorteners, and attacker-controlled hosts, while expanding phishing content into more than 30 languages.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On publication of its analysis, ESTsecurity's ESRC attributed the long-running global phishing activity to a Vietnam-linked threat actor it calls LoneNone and named the broader intrusion set the PyChain campaign. The report documented the campaign's technical evolution from late 2024 through January 2026.
East Security reported that phishing emails impersonating CEOs and executives were being continuously distributed against major companies. The messages used social engineering rather than immediate malware delivery, attempting to provoke replies or obtain messenger chat-room QR codes from recipients.
By January 2026, ESRC observed samples using a fake PDF executable based on Adobe's ADNotificationManager.exe to sideload a hidden DLL, download an encrypted RAR archive, unpack Python 3.10 runtime files and malicious scripts, and run an obfuscated Python payload. The malware then used Telegram and urlvanish.com to resolve second-stage infrastructure hosted at mongky68.godohosting.com and steal browser data, system information, and cryptocurrency wallet data.
Over more than a year, the PyChain intrusion set expanded across seven operations, adding signed executables for DLL sideloading, Telegram bots, URL shorteners, paste sites, and attacker-controlled infrastructure while keeping Python-based malware at its core. The campaign also broadened its lures beyond legal notices to business proposals, recruiting, and AI video tool themes in more than 30 languages.
A Vietnam-linked threat actor later named LoneNone began a phishing campaign in late 2024 using emails that claimed copyright infringement and lured targets into downloading ZIP archives with disguised executables. Early activity relied on trusted services such as GitHub and Dropbox for payload delivery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight a surge in **social-engineering-led initial access**, with attackers increasingly relying on trusted-looking delivery mechanisms rather than novel exploits. Microsoft-described activity impersonates *Zoom*, *Microsoft Teams*, and *Adobe Reader* updates and uses **stolen Extended Validation (EV) code-signing certificates** (including one issued to **TrustConnect Software PTY LTD**) to make malicious executables appear legitimate; lures include fake meeting invites and deceptive download sites, and payloads commonly install **RMM tooling** such as *ScreenConnect* and *MeshAgent* for persistent access, followed by additional tooling via encoded PowerShell. Separately, Moonlock reported a **ClickFix**-style operation targeting crypto/Web3 professionals via **fake venture capital personas on LinkedIn**, redirecting victims through Calendly to spoofed video-conferencing pages to induce execution of attacker-supplied commands, with infrastructure tied to multiple fake firms (e.g., *SolidBit Capital*, *MegaBit*, *Lumax Capital*) and domains attributed to a single registrant. In parallel, NCC Group’s Fox-IT assessed that **messaging platforms** (e.g., WhatsApp, Telegram, Discord, Signal, LinkedIn messaging) are increasingly used to deliver phishing links, malicious attachments, QR codes, and fake invitations while bypassing traditional email controls, and that Telegram in particular is also used to host phishing infrastructure, malware repositories, and bot-enabled fraud services. One referenced item is materially different from the above social-engineering theme: reporting on suspected **DPRK-linked intrusions** into cryptocurrency organizations describes web-app exploitation (including `CVE-2025-55182` in *React2Shell*) and the use of pre-obtained **AWS access tokens** to steal source code, private keys, and cloud secrets—an intrusion set focused on direct compromise and theft rather than the phishing/update-impersonation and messaging-platform delivery techniques described elsewhere.
Jun 29, 2026
Researchers and incident responders documented a targeted intrusion campaign by **CryptoMimic**—also tracked as **Dangerous Password**, **CageyChameleon**, and **Leery Turtle**—that focused on banks, financial organizations, and especially cryptocurrency businesses. The attacks used spear-phishing lures that delivered ZIP or RAR archives containing malicious `.lnk` shortcut files and decoy documents; when opened, the shortcuts launched `mshta.exe` to fetch remote HTML or VBScript payloads. JPCERT/CC said the activity hit Japanese organizations tied to cryptocurrency operations, while later analysis captured a full intrusion chain in which the initial script deployed staged implants including **Cabbage RAT** variants, a browser information stealer, **msoRAT**, and a credential theft component that abused Windows Security Packages. Across the reports, the malware showed consistent tradecraft: persistence through Startup-folder shortcuts and registry changes, victim filtering and antivirus checks, host reconnaissance via WMI, and command-and-control through **Bitly** links and spoofed cloud-themed domains such as **cloudfiles.club** and **msupdatepms.xyz**. The operators collected browser cookies, saved passwords, OS and hardware details, process lists, and likely system credentials, then used interactive follow-on access, including legitimate **VNC** tools, for manual post-compromise activity and possible cryptocurrency theft. Investigators also observed cleanup actions such as event log deletion and destructive behavior, and noted that the tooling and operational patterns shared multiple similarities with activity previously linked to **Lazarus**, though attribution remained unconfirmed.
Aug 15, 2026
A Vietnamese cybercriminal group known as Lone None has orchestrated a sophisticated phishing campaign that leverages fake copyright infringement notices to target individuals and organizations globally. The campaign, active since at least November 2024, begins with emails purporting to be from legitimate law firms, demanding the removal of allegedly infringing content from the recipient’s website or social media accounts. These emails are highly convincing, often referencing the recipient’s real online profiles and are translated into at least ten languages, including English, French, German, and Chinese, indicating a broad international targeting strategy. The phishing messages contain links that direct victims to download compressed archives, such as ZIP files, which masquerade as legal evidence documents in formats like PDF or PNG. Upon extraction, these archives contain malware that is executed using DLL side-loading, a technique that abuses trusted, signed applications—such as Microsoft Word or PDF readers—to bypass security controls and run malicious code undetected. The campaign delivers two primary types of information-stealing malware: Pure Logs Stealer and the more recent Lone None Stealer, also known as PXA Stealer. Pure Logs Stealer is designed to harvest a wide array of sensitive data, including passwords, credit card details, session cookies, and cryptocurrency wallet files stored on the victim’s device. The Lone None Stealer, first tracked by Cofense Intelligence in June 2025, is specifically engineered to target cryptocurrency assets. It monitors the victim’s clipboard for copied crypto wallet addresses and surreptitiously replaces them with addresses controlled by the attackers, thereby redirecting any intended cryptocurrency transfers. The campaign’s technical sophistication is further demonstrated by its use of Telegram bot profile pages for initial payload delivery and the deployment of obfuscated, compiled Python scripts to evade detection. Cofense Intelligence has observed that Lone None Stealer has appeared in 29% of all active threat reports involving Pure Logs Stealer since June 2025, highlighting its growing prevalence. The attackers also employ machine translation or AI tools to generate new email templates, allowing them to rapidly adapt and expand their reach. To further evade analysis and detection, the campaign abuses legitimate software such as Haihaisoft, leveraging their signed binaries for malicious purposes. The ongoing evolution of the campaign’s tactics, techniques, and procedures (TTPs) demonstrates a high level of operational agility and technical capability. The campaign’s focus on both personal and financial data, with a particular emphasis on cryptocurrency theft, poses significant risks to individuals and organizations alike. Security researchers recommend heightened vigilance for unsolicited legal notices, especially those containing download links or attachments, and advise organizations to implement robust email filtering and endpoint protection measures. The use of legitimate-looking legal threats and multi-language support increases the likelihood of successful social engineering, making this campaign particularly dangerous for a global audience. The campaign’s reliance on trusted software for malware execution underscores the importance of monitoring for unusual process behaviors and regularly updating security controls to detect DLL side-loading techniques. Organizations are urged to educate employees about the risks of phishing emails and to verify the authenticity of any legal correspondence received via email.
Jun 29, 2026