Trojanized Software Installers Sideload STX RAT and Steal Data via Hidden VM

Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch STX RAT in memory through a malicious CRYPTBASE.dll. Confirmed lures included fake packages for CPU-Z, X-VPN, Binance, MEXC, Bybit, Exodus, MetaTrader 5, and a Steam-themed decoy, with infrastructure tied to supp0v3[.]com and an actor tracked as Leda Elacoate. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version 77.5.3 with hardening changes after disclosure of the DLL search-order weakness.

Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed PureLogs Stealer for credential theft and PureHVNC via InstallUtil.exe, then staged prolonged data theft using rclone tunneled through a hidden QEMU Alpine virtual machine acting as a proxy. The observed operation lasted about five days and included roughly 54 hours of continuous exfiltration to 94.156.119[.]71:443, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.