Loading story…
MintsLoader, a multi-stage PowerShell malware loader also tracked as TAG-124, LandUpdate808, and UNC4108, has expanded operations across the US and Europe by targeting industrial, legal, energy, electricity, and oil-and-gas organizations. Reporting ties the activity to phishing emails, ClickFix-style lures, fake browser or software update pages on compromised websites, and SocGholish drive-by compromises. Researchers said the infection chain commonly starts with JavaScript or JScript files that launch heavily obfuscated PowerShell, perform AMSI bypass and anti-VM or sandbox checks, fingerprint victims, and use domain generation algorithms to rotate command-and-control infrastructure while serving decoys to analysis environments.
The campaigns have delivered multiple second-stage payloads, including StealC, GhostWeaver, and modified BOINC clients, with one observed chain downloading a packed StealC sample from temp[.]sh and another fake-update variant fetching staged content from attacker-controlled .top domains. Analysts described LandUpdate808 as a distinct fake-update cluster that evolved its staging URLs and visitor-tracking logic, while later reporting linked it directly to the broader MintsLoader ecosystem and to sustained operations by TAG-124, with SocGholish adopting the loader as an alternative delivery path. As of early 2026, researchers reported concurrent C2 clusters and more than 200 DGA domains, indicating a durable and growing malware delivery operation.
Pull IOCs and campaign context straight into your stack.
13 events from the most recent confirmed update back to the earliest known activity.
As of March 2026, researchers had identified more than 200 MintsLoader DGA domains across four clusters. The domains spanned activity from February 2024 through March 2026 and were registered through NICENIC with Hurricane Electric nameservers.
As of March 2026, TAG-124 was operating two concurrent MintsLoader command-and-control clusters at 178.156.128.182 and 86.107.101.93. The clusters were identified as versions v0.20 on Hetzner and v0.23 on Redoubt Networks.
During its response to the early January 2025 MintsLoader activity, eSentire said its SOC analysts isolated an affected customer host to contain the infection and assisted with remediation.
In the early January 2025 campaign, MintsLoader delivered second-stage payloads including the StealC information stealer and, in some cases, the BOINC client. In one observed case, the final stage downloaded a packed StealC sample from temp[.]sh and executed it.
eSentire's Threat Response Unit identified an ongoing MintsLoader campaign in early January 2025 targeting organizations in the United States and Europe, including electricity, oil and gas, and legal services. The campaign used spam emails linking to JScript files or ClickFix/KongTuke pages.
Between July and October 2024, MintsLoader was observed in widespread phishing campaigns targeting organizations in Europe, including Spain, Italy, and Poland. Orange Cyberdefense said the loader primarily delivered payloads such as AsyncRAT and Vidar through a multi-stage JavaScript and PowerShell infection chain.
SocGholish, also tracked as TA569, adopted MintsLoader around July 2024. It used fake browser update overlays injected into compromised websites to deliver the loader.
By July 2024, researchers documented LandUpdate808 shifting from hard-coded land.php endpoints to dynamically retrieved domains via get.php and remote js.php resources. Payload paths also moved from older WordPress locations to /wp-includes/pomo/update.php.
Researchers observed LandUpdate808 fake update campaign samples from April through July 2024. The campaign used compromised websites and fake update lures to deliver JS, EXE, and MSIX payloads.
Researchers identified MintsLoader DGA domains across four clusters spanning from February 2024 through March 2026. This indicates the loader's command-and-control infrastructure was active by February 2024.
MintsLoader activity expanded broadly from mid-2024 onward. Campaigns increasingly targeted industrial, legal, and energy organizations in the United States and Europe.
Orange Cyberdefense first observed the PowerShell-based malware loader MintsLoader in February 2023. The loader is also tracked as TAG-124, LandUpdate808, and UNC4108.
StealC was being sold as a malware-as-a-service offering starting in January 2023. It was advertised by its developer "Plymouth" on Russian-speaking underground forums.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 69 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourceesentire.com
Open sourcegithub.com
Open sourcemalasada.tech
Open sourcelevelblue.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**MintsLoader**, a multi-stage JavaScript-to-PowerShell loader associated primarily with TAG-124/LandUpdate808 and linked downstream activity to UNC4108/TA582, is targeting energy, industrial, legal, oil-and-gas, and other organizations in the United States and Europe. The campaigns use phishing, compromised websites, fake browser updates, and ClickFix/KongTuke fake CAPTCHA lures—including abuse of Italy's PEC certified-email system—to induce execution. The loader bypasses AMSI, scores hosts for sandbox or VM indicators, and uses rotating date-seeded DGA domains to retrieve payloads while sending AsyncRAT decoys to likely analysis environments. On selected victim systems, MintsLoader commonly deploys the fileless **GhostWeaver** PowerShell RAT, which uses TLS 1.0 over TCP/25658 and Gzip-compressed JSON for C2; StealC and modified BOINC clients have also been delivered. A newer variant retrieves an in-memory PowerShell stager through the legacy Finger protocol and uses Hashtable-based decoding plus a reflected, compressed .NET assembly to conceal later stages. Researchers identified active GhostWeaver C2 nodes at `178.156.128.182` and `86.107.101.93` that served a persistence installer with scheduled-task persistence, AV-aware behavior, and a CMSTPLUA UAC-bypass mechanism; defenders should prioritize detection of `finger.exe` spawning command interpreters, suspicious headless PowerShell tasks, AMSI-bypass activity, DGA-driven HTTP traffic, and GhostWeaver TLS on port 25658.
Sep 20, 2026
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026