Dragon Breath Uses Double DLL Sideloading to Steal Crypto Wallets
Malware Intelligence · 1 source · Updated 4mo ago · First seen Jan 1, 2026
Sophos reported that the threat group Dragon Breath—also tracked as APT-Q-27 and Golden Eye Dog—ran a multi-stage Windows malware campaign against Chinese-speaking users tied to online gambling, using trojanized installers themed as Telegram, LetsVPN, and WhatsApp. Victims were lured through infrastructure including telegramos[.]org, and observed targeting spanned the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China.
The attack used a novel double-clean-app DLL sideloading chain: a malicious installer dropped a first-stage package that later launched a second legitimate application, which then sideloaded a malicious DLL and decrypted the final payload. Sophos said the final malware acted as a backdoor geared toward cryptowallet theft, including checks for the MetaMask Chrome extension and clipboard manipulation, while attribution to Dragon Breath was supported by shared C2 infrastructure, the recurring ServerDll.dll naming pattern, and repeated use of renamed legitimate binaries from vendors including Shenzhen Thunder Networking Technologies, Baidu, HP, and KingdomTwoCrowns.
