Loading story…
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake Resident Evil 9 mod from GitHub triggered a curl | cmd chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to PureRAT, which persisted through the Run key and communicated over authenticated WebSockets with agent.sm-veo.com. Another Windows campaign, dubbed Operation TURB00, used a Go loader and decoy console program to launch Vidar in memory, steal browser and application data, and install persistence through agt.dll and the CadenceOptimizer service running under svchost as LocalSystem.
On macOS, analysts reversed a fully undetected Atomic macOS Stealer (AMOS) sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to 95.164.53.3/contact. In the software supply chain, a malicious PyPI package, nhmpy 2.4.7, masqueraded as NumPy while using a .pth file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named REDSUN showed how attackers could turn standard-user access into NT AUTHORITY\SYSTEM by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A multi-stage Windows malware sample was analyzed and clustered into a broader Operation TURB00 Vidar campaign. The Go-based loader decrypted an in-memory Vidar payload, and analysis revealed the primary C2 turbo88ku[.]top, Telegram and Steam dead-drop fallbacks, credential theft, and persistence via the CadenceOptimizer service.
A Windows 11 system was compromised after the user installed a fake Resident Evil 9 / REFramework mod from a GitHub repository. The infection chain used a malicious DLL to launch a remote curl | cmd sequence and staged an infostealer/RAT that persisted for about eleven days.
The typosquatted PyPI package nhmpy 2.4.7, which bundled legitimate NumPy alongside a .pth autostart file and obfuscated JavaScript malware, was removed from PyPI after being identified as a credential-stealing supply-chain worm. The package harvested a wide range of secrets and propagated using stolen GitHub tokens and malicious GitHub Actions workflows.
A staged malware chain delivered as DriveVideoSetup-x64-0.1.0.exe was observed using fake Google Drive or SMVEO-themed video lures. Analysis linked the final payload Uwjoqtb.dll to PureRAT and documented persistence, certificate creation under %LOCALAPPDATA%\SMVEO\, and authenticated WebSocket communications with agent.sm-veo.com.
A researcher using the alias Chaotic Eclipse released the Nightmare-Eclipse exploit suite in April 2026, including the REDSUN local privilege escalation exploit. REDSUN abuses a TOCTOU race involving NTFS and the Windows Cloud Files API to let a standard user gain NT AUTHORITY\SYSTEM privileges.
A macOS malware campaign abused sponsored search results, a fake GitHub repository, and Homebrew-themed installation steps to trick a user into running a malicious Bash command. The chain installed legitimate Homebrew, harvested the user's password, downloaded an obfuscated second-stage binary named "update" from cfocares[.]com, and used anti-analysis and encoded runtime commands to deliver additional payloads.
A Fully Undetected Atomic macOS Stealer sample distributed as Installer_v2.7.8.dmg was reverse engineered, revealing anti-VM checks, an encrypted AppleScript payload, and exfiltration to 95.164.53.3/contact. The analysis recovered the decrypted osascript from memory and documented theft of browser data, wallet files, Telegram data, documents, and system information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
mrtiepolo.medium.com
Open sourcejuliangrtz.me
Open sourcemeltedinhex.com
Open sourceblog.lukeacha.com
Open sourcemedium.com
Open sourcegithub.com
Open sourcemedium.com
Open sourcedenwp.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Threat researchers reported two large malware distribution operations that relied on popular consumer lures rather than software exploits. One campaign used piracy sites offering movies, TV shows, books, and digital library content to push fake plugin or browser update prompts; the downloaded ZIP files abused DLL side-loading, ROP-based decryption, and reflective loading to install a modified `SilentCryptoMiner`, a watchdog, a RAT component, and CPU/GPU miners. The malware gated execution through DNS tunneling and date-generated command-and-control infrastructure, harvested host data, and established persistence with a fake `GoogleUpdateTaskMachineQC` service and repeated UAC elevation attempts, with implicated sites drawing roughly 40 million visits in a single month. A separate operation used `openew[.]app`, a fake ChatGPT download page impersonating OpenAI, to infect both Windows and macOS users with platform-specific malware. Windows visitors received a credential-stealing loader disguised as `Chat_GPT.exe`, built with Inno Setup and Electron and launching PowerShell activity that contacted `188.137.246.189`, while macOS users were served **Atomic Stealer (AMOS)** to steal passwords, browser data, Telegram sessions, and cryptocurrency wallet information. Researchers said the macOS payload also attempted to replace legitimate Ledger and Trezor applications with trojanized versions, underscoring a strong cryptocurrency theft motive and showing how attackers are exploiting AI-brand search traffic and piracy demand to scale malware infections.
Jun 29, 2026