Loading story…
Researchers reported two active malware delivery operations centered on STX RAT, a remote access trojan aimed at stealing browser credentials, session tokens, and other access from financially valuable victims such as cryptocurrency traders. One campaign used a high-severity ClickFix chain built on the brand-squatted domain lirunex[.]tech, which impersonated a payment platform, used server-side cloaking to show a Swagger UI clone to non-targets, and silently replaced clipboard content so victims pasted a malicious command instead of an SSL certificate path. The staged execution launched through conhost --headless and ended with a cross-platform RAT hidden inside image files.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers identified a high-severity multi-step ClickFix attack using the brand-squatted domain lirunex[.]tech, clipboard manipulation, and a two-stage dropper chain. The campaign used server-side cloaking and ultimately delivered a cross-platform remote access trojan hidden in image files.
Researchers described an active campaign distributing 11 trojanized software packages to deliver STX RAT, initially targeting cryptocurrency traders and later expanding to Steam-themed and X-VPN lures. The operation used DLL sideloading, reflective in-memory loading, and supp0v3[.]com infrastructure, and continued evolving even after disclosure.
X-VPN released version 77.5.2 with stricter DLL loading, hash verification, and hardened DLL load policies. The update addressed the DLL search order weakness abused by the trojanized installer in the STX RAT campaign.
Howler Cell disclosed that a trojanized X-VPN installer was being used in an active STX RAT supply chain campaign. The package exploited a DLL search order weakness in the Windows client to sideload a malicious CRYPTBASE.dll.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at eSentire disclosed a previously undocumented remote access trojan, **STX RAT**, after it was used in an attempted intrusion against a financial services organization. The malware was delivered through a sophisticated multi-stage chain involving script launchers, encrypted and compressed payloads, privilege escalation, and in-memory PowerShell execution designed to avoid detection. Investigators said the RAT used **XXTEA** encryption, **Zlib** compression, reflective loading, layered string obfuscation, anti-virtualization checks, registry-based autoruns, and **COM hijacking** to establish persistence and frustrate analysis. Once deployed, STX RAT waited for command-and-control instructions and was built to steal data from browsers, FTP clients, and cryptocurrency wallets while minimizing early detection through delayed credential theft and an encrypted C2 protocol. The malware also supported hidden virtual desktop operations, execution of additional payloads, network tunneling, and simulated user input, giving operators broad post-compromise control. eSentire said the targeted environment was contained and urged organizations, particularly in financial services, to strengthen endpoint protections and reduce exposure to script-based initial access methods.
Jun 29, 2026
Researchers reported multiple **ClickFix** campaigns using fake CAPTCHA or reCAPTCHA prompts to trick users into manually running malicious commands, with payloads tailored by platform and victim profile. On Windows, one campaign delivered a modular NodeJS-based RAT and infostealer through a malicious MSI installer, loading key capabilities only in memory after command-and-control was established and using `gRPC` over Tor for persistent communications. An operational security failure exposed the malware’s backend protocol definitions and admin panel API, revealing a malware-as-a-service operation with multi-operator support, Telegram alerts, automation rules, and cryptocurrency wallet tracking. The malware also fingerprinted victims extensively and established persistence through the Windows Run registry key as **LogicOptimizer**. A separate ClickFix chain attributed with high confidence to **Grandoreiro** targeted users of eight Brazilian banks by luring victims through a fake reCAPTCHA page and launching a malicious PowerShell sequence that sideloaded a Delphi banking trojan with legitimate GoToMeeting and Nero binaries. The malware deployed banking overlays, intercepted **PIX** QR-code payments, added Microsoft Defender exclusions, and stole credentials, device information, signatures, and payment confirmation codes. Netskope also documented a macOS variant that used AppleScript and a persistent fake password dialog to harvest Keychain data, browser cookies, saved credentials, extension storage, and cryptocurrency wallet data; the theft of live session cookies can enable attackers to bypass MFA by hijacking authenticated sessions.
Jun 29, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026