Loading story…
Cato CTRL researchers reported an active phishing campaign targeting organizations in Brazil that delivers the legitimate NinjaOne remote monitoring and management agent instead of conventional malware. The operation uses Portuguese-language lures tied to fiscal records, supplier documents, complaint workflows, and secure file delivery, with victims routed through googleusercontent redirection chains to fake business portals. Once installed, the signed NinjaOne agent is configured for attacker-controlled access, giving the operators persistent, administrator-like remote control while bypassing many traditional malware detections.
The campaign was built to evade both users and defenders, using geofencing to Brazilian IP space, browser fingerprinting, sandbox and automation detection, honeypot checks, hidden iframes, and human-interaction validation before serving payloads. Researchers said at least one organization in the chemicals and advanced materials sector was targeted, and they expanded tracking by pivoting on a reused wallpaper image across attacker domains. Parts of the infrastructure were reported to Cloudflare, but some remained accessible in early June, while overlaps with infrastructure previously linked to Venon RAT were observed but remain unconfirmed.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Cato CTRL documented an active phishing campaign targeting Brazilian organizations with Portuguese-language lures themed around fiscal documents, complaint workflows, and secure document delivery. Victims are redirected through Googleusercontent-based links to fake portals and tricked into installing a legitimate NinjaOne agent configured for attacker-controlled remote access.
On its publication date, Cato Networks publicly disclosed research describing the NinjaOne RMM abuse chain, including geofencing, fingerprinting, sandbox evasion, and possible but unconfirmed overlaps with infrastructure linked to Venon RAT activity.
Cato researchers reported parts of the attacker infrastructure to Cloudflare. The blog notes that some of the infrastructure was still accessible as of 2026-06-04.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported a phishing campaign that delivered the **NetSupport Manager** remote access trojan (RAT) to victim systems. The activity used malicious email lures to trick users into opening weaponized attachments or links, after which the attackers installed NetSupport Manager to gain remote control over infected hosts and establish persistent access. The campaign highlighted how legitimate remote administration software can be repurposed for intrusion activity, allowing attackers to monitor systems, execute commands, and potentially move deeper into compromised environments. Unit 42 said **Cortex XDR** detected the operation, underscoring the continued risk posed by phishing-driven malware delivery and dual-use remote management tools in enterprise networks.
Jul 12, 2026
Multiple reports highlight **social engineering and phishing** as primary initial-access vectors, with attackers increasingly targeting **identity systems** rather than exploiting software vulnerabilities. Microsoft was again the most spoofed brand in phishing during Q4 2025 (22% of observed brand-impersonation attempts), reflecting how attackers abuse trust in major identity and productivity platforms to harvest credentials; examples cited include lures mimicking Netflix account recovery, Roblox-related pages, and Spanish-language Facebook scams. Separately, an incident response case described payroll fraud achieved without malware or a network breach: an attacker impersonated employees to help desks, reset passwords, re-enrolled MFA, and registered an external email as an authentication method in **Azure Active Directory**, then altered direct-deposit details to redirect paychecks—underscoring how **help-desk processes and MFA reset workflows** can be exploited for persistence and financial theft. Targeted campaigns also show continued evolution in delivery tradecraft for **remote access**. A spear-phishing operation against Argentina’s judicial sector used ZIP attachments containing a weaponized Windows shortcut (`.lnk`) masquerading as a PDF plus scripts and a decoy court document to deploy a **Remote Access Trojan** while minimizing user suspicion. In parallel, research described **Pulsar RAT** (a Quasar RAT derivative) emphasizing stealth via **memory-only execution** and **HVNC**, with TLS-encrypted C2 and configuration retrieval from public paste sites, alongside persistence mechanisms such as scheduled tasks and UAC-bypass techniques. Another campaign attributed to **Konni APT** (“Operation Poseidon”) abused **Google and Naver ad redirection** (e.g., `ad.doubleclick[.]net`, `mkt.naver[.]com`) to launder clicks through trusted ad infrastructure before landing victims on compromised sites hosting malware, demonstrating how open-redirect and ad-tech trust can bypass reputation-based controls.
Jun 29, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026