Loading story…
SentinelOne reported that MalVirt is being used in malvertising campaigns to deliver malware while relying on .NET virtualization to hinder analysis and evade detection. The technique obscures malicious logic inside virtualized .NET code, complicating reverse engineering and allowing attackers to disguise payload behavior during delivery through fraudulent online advertisements.
The activity highlights how threat actors are pairing malvertising with stronger code-protection methods to improve payload survivability against security tools and researchers. For defenders, the campaign underscores the need to monitor ad-driven infection chains, inspect suspicious .NET binaries for virtualization-based obfuscation, and strengthen controls around web filtering, endpoint detection, and user exposure to malicious ads.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelOne published research describing MalVirt and its use of .NET virtualization in malvertising attacks. The reference does not provide an explicit earlier event date for the underlying activity beyond the publication itself.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Dead#Vax** malware campaign delivers payloads through multi-stage **VHD** disk image files and heavily obfuscated batch scripts that parse themselves to reconstruct and launch shellcode directly in memory. The intrusion chain relies on **fileless execution** techniques in Windows, reducing on-disk artifacts and complicating detection, while the staged delivery mechanism helps operators evade traditional security controls. Public reporting said the malware uses self-parsing scripts and in-memory shellcode deployment to maintain stealth across infected systems, with Securonix warning that the campaign abuses native Windows functionality as part of its execution flow. The activity was described as a sophisticated, multi-stage operation designed to blend into normal system behavior, underscoring the need for defenders to monitor suspicious use of virtual disk images, script interpreters, and memory-resident execution patterns.
Jul 12, 2026
Multiple reports detail **social-engineering-driven malware delivery** that results in **remote access trojans (RATs)** and credential theft. Infoblox described observing an affiliate push-notification ad network after exploiting misconfigured DNS delegations (“**Sitting Ducks**”/lame name server delegation) to take over abandoned threat-actor domains, allowing collection of **~57M logs** over two weeks and visibility into widespread **scams and brand impersonation** delivered via push ads. Nextron Systems separately reported recurring **malvertising** chains where “free converter” tools (e.g., document/image converters) downloaded from ads on legitimate sites function as advertised while covertly installing **persistent RATs**, with common artifacts such as Windows **Mark-of-the-Web** (`ZoneId=3`) indicating internet origin. Other activity in the set reflects different initial-access lures but the same general outcome—RAT-style access and data theft. Fortinet analyzed a **phishing** campaign using a fake Vietnam shipping document: a Word attachment leads to an RTF stage that exploits an RTF-related vulnerability, then uses **VBScript/PowerShell** to load a **fileless .NET module**, ultimately downloading and injecting a **Remcos** variant (including process hollowing) to provide full remote control. Separately, reporting on North Korea’s **“Contagious Interview”** campaign described fake recruiter outreach (e.g., via LinkedIn) that tricks developers into opening malicious code repositories; execution can be triggered via a hidden **VS Code `tasks` configuration**, server-side logic hooks, or a malicious npm dependency to steal credentials/crypto wallets and establish persistence—this is thematically similar (social engineering leading to remote access) but is a distinct operation from the malvertising/push-ad and Remcos phishing activity.
Jun 29, 2026
Curly COMrades, a threat actor aligned with Russian geopolitical interests, has been observed leveraging Microsoft's Hyper-V hypervisor to deploy hidden Alpine Linux-based virtual machines on compromised Windows systems. By enabling Hyper-V via the DISM command-line tool and disabling its graphical management interface, the attackers create a concealed environment to run malware payloads such as CurlyShell and CurlyCat, evading detection by traditional endpoint security tools. The malicious VM is configured to use the Default Switch network adaptor, ensuring that all outbound traffic appears to originate from the legitimate host machine, further complicating detection and response efforts. This technique allows the threat actors to operate outside the visibility of the host operating system, making it difficult for defenders to identify malicious activity. The campaign, first observed in July 2025, highlights a growing trend of sophisticated evasion tactics that blend virtualization technology with advanced persistence mechanisms. Victim identities have not been publicly disclosed, but the method demonstrates a significant escalation in the use of virtualization for stealthy cyber operations targeting Windows environments.
Jun 29, 2026