Loading story…
A multi-actor malware campaign is abusing the legitimate ahost.exe utility to sideload malicious libcares-2.dll files and evade signature-based defenses. Trellix reported that attackers are pairing signed or renamed copies of ahost.exe—a component of the c-ares library commonly bundled with Git for Windows and tools such as GitKraken—with weaponized DLLs to launch a wide range of payloads, including DCRat, XWorm, AgentTesla, FormBook, Lumma Stealer, Vidar, CryptBot, Remcos, and QuasarRAT.
The activity appears broadly distributed worldwide and is using deceptive document-style filenames in multiple languages, including Arabic, Spanish, Portuguese, Farsi, and English, to lure victims. Reported targeting includes employees in finance, procurement, supply chain, and administration across commercial and industrial sectors such as oil and gas and import/export. In one documented DCRat intrusion, attackers renamed ahost.exe to 1DOC-PDF.exe, loaded a malicious DLL, launched AddInProcess32.exe, and maintained persistence by injecting into that process; Trellix urged defenders to prioritize behavioral detection, application control, endpoint hardening, threat intelligence integration, and automated response to counter the sideloading technique.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Trellix observed the campaign using deceptive document-like filenames such as order.exe, RFQ-themed executables, and localized names in Arabic, Spanish, Portuguese, Farsi, and English to induce execution. The filenames indicated a phishing component targeting commercial and industrial organizations including oil and gas and import/export firms.
Trellix stated that GitKraken collaborated with the company and addressed the issue through its bug bounty and service processes after its signed ahost.exe binary was implicated in the sideloading activity. The report highlighted a GitKraken-signed sample associated with multiple malware campaigns.
In one observed case, attackers renamed ahost.exe to 1DOC-PDF.exe and bundled it with a malicious libcares-2.dll carrying DCRat. When executed, the DLL launched AddInProcess32.exe, injected into that process, and persisted under its guise while initiating DNS and C2 activity including contact with dgflex[.]duckdns[.]org.
Trellix reported an active malware campaign in which multiple threat actors abused the legitimate ahost.exe utility by pairing it with a malicious libcares-2.dll to execute payloads. The activity delivered malware including DCRat, XWorm, AgentTesla, FormBook, Lumma Stealer, Vidar, CryptBot, Remcos, and QuasarRAT against business users in roles such as finance, procurement, supply chain, and administration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Multiple active malware campaigns are using **social engineering** and **trojanized content** to compromise Windows systems, with lures ranging from pirated software downloads to business and shipping documents. AhnLab reported a “proxyjacking” operation attributed to **Larva-25012** that distributes fake installers (notably a trojanized *Notepad++* package) via cracked-software sites; the `Setup.zip` bundle includes a legitimate `Setup.exe` plus a malicious sideloaded DLL (`TextShaping.dll`) that decrypts and installs **DPLoader** for persistent command retrieval and follow-on payload delivery. The malware also tampers with defenses by changing Microsoft Defender settings (e.g., exclusions, reduced notifications, and blocking sample submission) to reduce detection while monetizing victims’ bandwidth through installed **proxyware**. Separately, FortiGuard Labs described a Russia-focused, multi-stage intrusion chain that abuses trusted services (**GitHub** and **Dropbox**) for payload hosting and weaponizes **Defendnot** (a Windows Security Center trust-model research tool) to disable **Microsoft Defender** before deploying a ransomware payload. Fortinet also documented phishing campaigns using weaponized shipping-themed Word documents to deliver **Remcos RAT**, including fileless execution behavior and exploitation of `CVE-2017-11882` (Microsoft Equation Editor) via remotely fetched templates. These campaigns reinforce the operational risk from user-driven execution paths (pirated installers and document lures), “living off the land” techniques, and defense evasion through both policy tampering and security tooling abuse.
Jun 29, 2026