Loading story…
Researchers traced multiple SmokeLoader operations to live command-and-control infrastructure that supported credential theft, screenshot capture, clipboard theft, host profiling, and data exfiltration. One March 2026 campaign used a ClickFix social-engineering lure, an MSI installer, and a Go-based loader to deploy the Remus plugin, with exfiltration sent to baxe[.]pics:48261; investigators extracted configuration data including the C2 URL, campaign ID, plugin markers, and a ChaCha20 key that allowed captured traffic to be decrypted. Cross-sample analysis linked the same builder output to SmokeLoader deliveries via Amadey, Phorpiex, and the ClickFix/GOLoader chain, pointing to a shared malware-as-a-service or affiliate ecosystem.
Separate analysis tied SmokeLoader to a broader dual-family operation involving Fuery, likely run by an operator using the alias "ingermany", who used a Flask-based panel disguised as "InsureFlow Pro" and a second "Monkey" panel for Fuery management. Investigators documented repeated OPSEC failures across the infrastructure, including reused certificates, exposed registration data, same-day domain registrations, and a C2 domain that shared a VPS with a legitimate Arabic-language learning platform, qimmaedu[.]com, while malware traffic beaconed to coox[.]live and baxe[.]pics. The reports also highlighted unusual technical overlaps, including Go 1.20.1 builds, Raft protocol type-name obfuscation, split C2 services on high ports, and hosting links to providers and subnets previously associated with Phorpiex, reinforcing the assessment that financially motivated operators were reusing infrastructure across malware families and legitimate services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers found the same builder output across SmokeLoader samples delivered via Amadey, Phorpiex, and the ClickFix/GOLoader chain, indicating a shared malware-as-a-service or affiliate distribution ecosystem. The activity was assessed as financially motivated cybercrime, with Vietnamese and Eastern European infrastructure indicators but no definitive attribution.
Breakglass Intelligence traced the March 2026 campaign to a live command-and-control server at baxe[.]pics:48261 on an OVH Singapore VPS and extracted the Remus plugin configuration, including the C2 URL, campaign ID, plugin markers, and a ChaCha20 key. These findings enabled decryption of captured traffic and exposed multiple operator OPSEC failures, including certificate reuse and same-day domain registrations.
In March 2026, researchers analyzed a SmokeLoader campaign that used a ClickFix social-engineering lure, an MSI installer, and a Go-based loader to deploy the Remus plugin. The infection chain included credential theft, wallet targeting, and deployment of a plugin capable of screenshot capture, clipboard theft, and host profiling.
Breakglass Intelligence published findings that linked SmokeLoader and Fuery infrastructure, domains, certificates, and hosting history to a likely single operator distinct from CERT-UA's UAC-0006. The report also highlighted OPSEC failures and overlap with infrastructure associated with Phorpiex-hosting environments.
Breakglass Intelligence reported that baxe[.]pics shared infrastructure with qimmaedu[.]com on the same Hetzner VPS, and that a public source map for the LMS leaked developer artifacts linked to the handle sasa4452. The report assessed that the same operator likely reused the VPS for both legitimate projects and SmokeLoader infrastructure.
On March 5, 2026, sandbox analysis of a SmokeLoader sample showed active beaconing to coox[.]live and exfiltration to baxe[.]pics on port 48261, with more than 1 MB of stolen data sent during a single run. Researchers tied baxe[.]pics to a Hetzner VPS that also hosted the legitimate Arabic LMS site qimmaedu[.]com.
A threat actor using the alias "ingermany" stood up a live botnet operation that ran SmokeLoader and Fuery through separate but linked command-and-control panels, including a Flask-based panel disguised as "InsureFlow Pro" and Fuery infrastructure branded as the "Monkey" panel. The infrastructure and malware families shared hosting, build traits, and a Raft-protocol-themed obfuscation method.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple financially motivated malware campaigns using **SmokeLoader** as a delivery mechanism for follow-on payloads including **Gozi ISFB**, **ZLoader**, **Oski**, **AveMaria**, **Cobalt Strike**, **SystemBC**, **RecordBreaker**, and the **Laplas Clipper** cryptocurrency hijacker. In one campaign set, attackers abused website contact forms and sent phishing lures posing as copyright complaints, directing victims to malicious documents hosted on legitimate services such as **Google Drive**. Talos found the initial payloads were wrapped in a shared crypter identified by the DOS-stub string **"Salfram,"** indicating a common tooling layer across otherwise varied malware deliveries. The activity relied on evasive and modular infection chains designed to complicate detection and maximize monetization. The **Salfram** crypter used obfuscation methods including fake API calls, fragmented control flow, self-modifying code, and memory allocation through `ZwAllocateVirtualMemory`, while later-stage malware added persistence and theft capabilities. Cyble said **Laplas Clipper** monitored the clipboard for cryptocurrency wallet addresses, pulled regex patterns and replacement addresses from `clipper[.]guru`, and persisted by copying itself into `%appdata%` and creating a scheduled task that ran every minute. The combined use of phishing, legitimate hosting platforms, crypter-based obfuscation, and multi-payload delivery shows an adaptable criminal ecosystem built to steal credentials, proxy access, banking data, and cryptocurrency funds.
Aug 15, 2026
Researchers detailed how **SmokeLoader** continues to operate as a heavily obfuscated, multi-stage malware loader that hides its execution flow and decrypts later payloads in memory before contacting command-and-control infrastructure. Reverse-engineering of recent samples showed opaque predicate obfuscation, encrypted functions, API hashing based on `djb2` with an added XOR layer, and a compressed third stage that is decrypted with XOR keys before being unpacked with **LZSA2**. Analysts also reported that the final decrypted stage can have a damaged PE header while retaining usable sections, complicating static analysis but still allowing recovery of configuration data such as RC4-encrypted strings and multiple C2 URLs. Separate analysis traced a Visual Basic Script infection chain that used `wscript.exe` to launch an obfuscated PowerShell downloader, which then fetched an executable from `americanocoffea[.]ru` into the victim's temp directory and executed it as a SmokeLoader payload. One investigated sample was observed delivering the **Vidar** infostealer, reinforcing SmokeLoader’s role as a malware distribution platform rather than a single-purpose implant. Public research from CERT Polska and independent analysts collectively highlights SmokeLoader’s layered packing, staged delivery, and reusable infrastructure as key factors that make the malware effective for initial access and follow-on payload deployment.
Aug 15, 2026
Threat researchers reported a malware campaign that used fake privacy-tool websites to trick users into downloading trojanized Windows installers that delivered **SmokeLoader**. Identified lure domains included `privacytools[.]xyz`, `privacytoolsforyou[.]site`, `privacmytools[.]site`, and `privacy-tools-for-you-777[.]com`, with one malicious installer tracked by SHA-256 `47906fc0ac7d3be54c62933e5f66a285cd34f161ce1d8a1bbdf80dc2e1df1441`. The operation relied on spoofed software-download pages and rogue file-hosting sites designed to resemble legitimate privacy software distribution. Investigators linked the activity to a broad and frequently changing infrastructure that included at least 26 fake privacy-tool domains, 18 related file-hosting domains, numerous command-and-control URLs across TLDs such as `.space`, `.ru`, `.site`, `.xyz`, and `.com`, and shared bulletproof hosting. Some file-hosting domains also appeared to serve as **SmokeLoader** C2 nodes, while additional indicators included DNS-linked IP addresses and RSA key material associated with encrypted malware communications, underscoring a coordinated malware delivery and control network.
Aug 15, 2026