Malvertising and Custom Backdoors Drove Credential Theft and Espionage Campaigns

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

1 linked

Arid Viper

Malware

4 linked

Rhadamanthys Micropsia AMOS Arid Gopher

Observables

20 linked

Domain••••••.comIPv4 address•••.•••.••.•••URLhttps://•••••••.•••/••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain••••••••••.comIPv4 address•••.•••.••.•••URLhttps://•••••.•••/••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+12

Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.

Hunt This Malware

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Malwarebytes LabsNews · Feb 28, 2024

One year later, Rhadamanthys is still dropped via malvertising - ThreatDown by MalwarebytesOpen source ↗

Symantec Enterprise BlogsNews · Apr 4, 2023

Mantis: New Tooling Used in Attacks Against Palestinian Targets | SECURITY.COMOpen source ↗

On the same thread

Multiple reports detail **social-engineering-driven malware delivery** that results in **remote access trojans (RATs)** and credential theft. Infoblox described observing an affiliate push-notification ad network after exploiting misconfigured DNS delegations (“**Sitting Ducks**”/lame name server delegation) to take over abandoned threat-actor domains, allowing collection of **~57M logs** over two weeks and visibility into widespread **scams and brand impersonation** delivered via push ads. Nextron Systems separately reported recurring **malvertising** chains where “free converter” tools (e.g., document/image converters) downloaded from ads on legitimate sites function as advertised while covertly installing **persistent RATs**, with common artifacts such as Windows **Mark-of-the-Web** (`ZoneId=3`) indicating internet origin. Other activity in the set reflects different initial-access lures but the same general outcome—RAT-style access and data theft. Fortinet analyzed a **phishing** campaign using a fake Vietnam shipping document: a Word attachment leads to an RTF stage that exploits an RTF-related vulnerability, then uses **VBScript/PowerShell** to load a **fileless .NET module**, ultimately downloading and injecting a **Remcos** variant (including process hollowing) to provide full remote control. Separately, reporting on North Korea’s **“Contagious Interview”** campaign described fake recruiter outreach (e.g., via LinkedIn) that tricks developers into opening malicious code repositories; execution can be triggered via a hidden **VS Code `tasks` configuration**, server-side logic hooks, or a malicious npm dependency to steal credentials/crypto wallets and establish persistence—this is thematically similar (social engineering leading to remote access) but is a distinct operation from the malvertising/push-ad and Remcos phishing activity.

Jan 15, 2026

Credential-Theft Malware Campaigns Targeting Windows via Social Engineering and Trusted Services

Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.

Feb 20, 2026

Multi-Stage Phishing and DLL Sideloading Campaigns Deliver Vidar, PlugX, and Other Stealers

Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.

Jun 22, 2026

Malvertising and Custom Backdoors Drove Credential Theft and Espionage Campaigns

How this story unfolded

Malvertising ad impersonating Notion first appears

Mantis conducts 2022–2023 campaign against Palestinian organizations

Related entities

Threat actors

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Malvertising and Custom Backdoors Drove Credential Theft and Espionage Campaigns

How this story unfolded

Malvertising ad impersonating Notion first appears

Mantis conducts 2022–2023 campaign against Palestinian organizations

Related entities

Threat actors

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Malvertising and Custom Backdoors Drove Credential Theft and Espionage Campaigns

How this story unfolded

Malvertising ad impersonating Notion first appears

Mantis conducts 2022–2023 campaign against Palestinian organizations

Related entities

Threat actors

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Malware Delivery via Deceptive Lures: Malvertising, Fake Recruitment Repos, and Phishing Dropping RATs

Credential-Theft Malware Campaigns Targeting Windows via Social Engineering and Trusted Services

Multi-Stage Phishing and DLL Sideloading Campaigns Deliver Vidar, PlugX, and Other Stealers

Malvertising and Custom Backdoors Drove Credential Theft and Espionage Campaigns

How this story unfolded

Malvertising ad impersonating Notion first appears

Mantis conducts 2022–2023 campaign against Palestinian organizations

Related entities

Threat actors

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Malware Delivery via Deceptive Lures: Malvertising, Fake Recruitment Repos, and Phishing Dropping RATs

Credential-Theft Malware Campaigns Targeting Windows via Social Engineering and Trusted Services

Multi-Stage Phishing and DLL Sideloading Campaigns Deliver Vidar, PlugX, and Other Stealers