Loading story…
Breakglass Intelligence reported a previously unreported malware family, SEAL RAT, delivered through a Czech-language job-phishing campaign targeting job seekers with a fake confidential recruitment offer impersonating Robert Walters s.r.o. The lure referenced EDEKA Czech Republic expansion plans and presented a polished NDA-signing application, including the file NDAvia_Nabidka_Linzer.exe, to harvest victim trust and input. The PE32+ dropper silently launched a second-stage loader that used a proof-of-work anti-sandbox delay before decrypting and executing the RAT, which then beaconed over HTTP to http://sealchecks.com/index.php.
The malware supports host reconnaissance, discovery of at least 17 security products including CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint, keylogging, remote shell access, file download-and-execute, persistence, and data exfiltration. Researchers said the dropper was signed with a short-lived Microsoft Trusted Signing AOC certificate issued to "Robert Walters, Placentia, CA," which expired within three days and likely reduced the chance of effective revocation. The campaign infrastructure was assembled within roughly six days, with command-and-control activity confirmed in mid-March, while attribution remains low confidence because the malware appears novel and has not yet been reliably linked to a known cluster.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Breakglass Intelligence published research on a previously unreported malware family dubbed SEAL RAT, detailing its Czech-language job-phishing lure, proof-of-work anti-sandbox technique, and use of a Microsoft-signed certificate. The researchers said attribution remained low confidence because the malware appeared novel and lacked prior campaign clustering.
Breakglass Intelligence confirmed the campaign's command-and-control endpoint at sealchecks.com was active. The malware beaconed over HTTP and supported reconnaissance, security product discovery, keylogging, remote shell access, persistence, file execution, and data exfiltration.
A previously unreported phishing campaign impersonated Robert Walters s.r.o. and used a fabricated confidential job offer tied to EDEKA Czech Republic expansion plans to lure Czech-speaking job seekers. The lure delivered a signed executable, NDAvia_Nabidka_Linzer.exe, that displayed a Czech-language interface and launched the SEAL RAT infection chain.
The campaign abused a Microsoft Trusted Signing AOC certificate issued to "Robert Walters, Placentia, CA," which expired within three days. The certificate was used to sign the malicious PE32+ dropper masquerading as an NDA-signing tool for a Czech recruitment offer.
Breakglass Intelligence reported that the infrastructure supporting the SEAL RAT campaign was rapidly assembled over a six-day period in March 2026. The operation used a signed dropper and command-and-control infrastructure centered on sealchecks.com.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Two recruitment-themed malware campaigns use decoy job documents to deliver multi-stage, memory-resident implants after a single click. One campaign distributes a ZIP archive containing a renamed `WinWord.exe` that DLL-side-loads a malicious component to deploy **PureRAT/ResolverRAT**; researchers assess its infrastructure and tradecraft as overlapping with the Vietnam-nexus PXA Stealer criminal cluster. The other disguises an LNK shortcut as a PDF, invokes `mshta.exe`, and retrieves a custom native implant that decrypts and reflectively maps its DLL payload in memory. The second operation has not been attributed to a known threat actor. Both chains reduce Windows telemetry and analysis visibility through sandbox-evasion measures and Task Scheduler COM-based persistence rather than `schtasks.exe`, while providing attackers remote-access capability. The PureRAT campaign adds scheduled tasks, WMI event subscriptions, COM hijacking, and mirrored staging directories that can restore removed artifacts. The activity follows prior reporting on job-offer social engineering used to deploy Pure-family malware, including PureHVNC and PureRAT-linked tooling, and shows the continued use of this ecosystem alongside heavily obfuscated loaders and persistence mechanisms.
Sep 10, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026