Loading story…
Breakglass Intelligence reported that the CountLoader malware campaign used polyglot HTA files disguised as benign formats including .wav, .xml, .mp4, .ini, and .csv to trigger execution through mshta.exe on Windows. The loader combined layered obfuscation, sandbox and CrowdStrike Falcon-specific evasion, scheduled-task persistence, multiple payload download fallbacks, and a USB LNK worm capability. Its theft focus was unusually broad, targeting 76 cryptocurrency wallet browser extensions, 6 desktop wallet applications, and data from 66 Chromium-based browsers, while also retaining Active Directory reconnaissance modules that could support later enterprise compromise and ransomware activity.
Researchers said the operator rapidly evolved the campaign over several days, publishing 28 new samples to MalwareBazaar, rotating three of four known C2 IPs, adding new C2 domains and a tracking beacon, and simplifying the protocol in CountLoader v4.1.1 by removing a UTF-16LE layer while still exposing the XOR key in plaintext. Despite the churn, stable fingerprints such as a constant CLSID and unchanged wallet-stealing and reconnaissance modules persisted. The infrastructure used domains registered through NiceNIC, separate Cloudflare accounts and nameserver pairs for compartmentalization, and backend hosting across multiple providers, with earlier analysis tying five active C2 domains and one related domain to a single AlexHost IP in Moldova. Breakglass assessed the actor as a likely Russian-speaking cybercrime or MaaS operator with strong infrastructure management but only moderate payload-development sophistication.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
McAfee Labs registered the CountLoader backup domain hell10-kitty[.]cc and sinkholed malware traffic, observing about 5,000 connections per minute and roughly 86,000 unique infected machines. The analysis also found USB-spread via malicious LNK shortcuts affecting about 9,000 infections and documented the campaign deploying cryptocurrency clipper malware.
Analysis of the April 7 XWorm campaign found attribution signals pointing to a Brazilian operator, including Portuguese-language markers, a Brazilian DDNS domain, and a final C2 on a Telefonica Brasil residential IP. The staging infrastructure on magina.online was also found to expose MariaDB and FTP services, and notifications were sent to Hostinger, Telefonica Brasil, and BluePex/Winco.
A new XWorm campaign was first seen using a multi-stage chain with a 7z archive, obfuscated JavaScript, PowerShell hidden in an environment variable, steganographic JPEG payloads from magina.online, and a .NET loader named Fiber.Program. The final XWorm RAT was process-hollowed into Caspol.exe, with the loader reusing public HackForums process-hollowing code.
Between March 8 and March 12, the CountLoader operator rotated three of four known C2 IPs, added new C2 domains and a new tracking beacon, and published 28 additional samples to MalwareBazaar. Researchers also observed CountLoader v4.1.1 simplifying its protocol by removing a UTF-16LE layer while still exposing the XOR key in plaintext.
A coordinated CountLoader campaign was published to MalwareBazaar, using polyglot HTA files disguised as benign extensions to execute via mshta.exe on Windows. The malware targeted 76 cryptocurrency wallet browser extensions and 6 desktop wallet applications, while also stealing from 66 Chromium-based browsers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 133 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
mcafee.com
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain `maybedontbanplease[.]com` as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via `pythonw.exe`; the installer was signed with an EV certificate issued to the likely fictitious entity **SERPENTINE SOLAR LIMITED**. The activity was attributed with medium-high confidence to **GrayBravo** and linked to delivery of **LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT,** and **SectopRAT**, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations. A separate operation distributed a trojanized `MSTeamsSetup.exe` that installed a weaponized **RustDesk** client and communicated with `mon.systemautoupdater[.]com` on EvoXT infrastructure, while presenting a TLS certificate for `calipology[.]com`, tying the activity to the **GeorgeGinx/Striker** operator. In another live campaign, attackers used the compromised Syrian web development site `allsydevs[.]com` to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to `172[.]93[.]167[.]12:4263` over HTTPS using a self-signed certificate with the fake common name **Mesh Data**; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.
Jun 29, 2026Researchers have identified CountLoader, a new malware loader used by Russian ransomware groups to deliver tools like Cobalt Strike and PureHVNC RAT. The loader is distributed via phishing campaigns, particularly targeting Ukraine, and leverages multiple file types and living-off-the-land binaries for persistence and execution. CountLoader's infrastructure supports major ransomware affiliates and demonstrates advanced malware development techniques.
Jun 29, 2026