Loading story…
Researchers reported that Win64/Expiro.A can infect both 32-bit and 64-bit Windows executables, allowing the malware to spread widely across local disks, removable media, and network drives. The file infector can repeatedly re-establish itself from any remaining tainted executable, complicating cleanup and increasing the risk of enterprise-wide reinfection.
Beyond file infection, the malware steals credentials and sensitive data from Internet Explorer, Microsoft Outlook, FileZilla, and Windows certificate stores, while also manipulating browsers by installing malicious extensions for Google Chrome and Mozilla Firefox. It can intercept web form data tied to banking and payment activity, disable protections including Windows Defender and Security Center, terminate security-related processes, and provide botnet functions such as remote command execution, plugin loading, proxying, port forwarding, and TCP flood attacks.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
McAfee documented a new Expiro variant that reduces and encrypts the base relocation table in infected executables, making traditional repair routines more likely to corrupt files unless the relocation data is restored correctly. McAfee said its products detect the malware as W32/Expiro.gen.rd and W64/Expiro.d and can repair infected files starting from DAT Version 8665.
Microsoft documented the Win32/Expiro malware family as a Windows file infector that spreads by infecting executables and .LNK-referenced files, steals credentials and certificates, and connects to remote servers for command-and-control. The description also noted browser redirection via a Firefox extension and weakened Internet Explorer security settings through registry changes.
ESET analyzed a new Expiro file-virus modification detected as Win64/Expiro.A, alongside the related 32-bit detection Win32/Expiro.NBF. The variant can infect both 32-bit and 64-bit Windows executables and spread via local, removable, and network drives while also stealing credentials and manipulating browsers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 54 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
mcafee.com
Open sourcewelivesecurity.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro documented **`PE_MOFKSYS.A`** as a Windows file-infector that also operates as a backdoor, spreading through dropped payloads and malicious websites while copying itself under deceptive names including `explorer.exe`, `svchost.exe`, `spoolsv.exe`, `mrsys.exe`, and `stsys.exe`. The malware establishes persistence through scheduled tasks and multiple Windows Registry autostart locations, including **Winlogon** and **Run** keys, and it also disables the `SharedAccess` service and changes settings to hide hidden files. Once active, `PE_MOFKSYS.A` can receive updates from remote operators, download additional files, capture screenshots, log keystrokes, monitor mouse clicks and active window titles, and communicate with command-and-control infrastructure hosted on domains such as **`t35.com`**, **`atspace.com`**, and **`zxq.net`**. It also steals email configuration data, instant messenger credentials, browsing history, and clipboard contents, exfiltrates data through its own SMTP engine using Gmail accounts, infects `.EXE` files across local and removable drives, and exposes an **All Users Application Data** folder over the network, increasing both persistence and lateral exposure.
Aug 15, 2026
Attackers ran a multi-stage information-stealing campaign against victims in Latin America and Asia Pacific by distributing password-protected archives disguised as pirated software. Trellix reported that the infection chain abused legitimate **Cisco Webex** binaries for **DLL sideloading**, which launched **HijackLoader** and then **Vidar Stealer** through an **AutoIt3** component, enabling theft of browser credentials and communication with command-and-control infrastructure. The campaign used several defense-evasion and post-compromise techniques, including a **COM-based UAC bypass**, adding **Windows Defender** exclusions, and injecting into **`MSBuild.exe`**. Trellix said the malware also fetched additional payloads and ultimately launched a cryptominer via **`AddInProcess.exe`**, describing the operation as a fresh and evasive threat with low detections in threat feeds despite clear execution-chain visibility in EDR telemetry.
Aug 14, 2026
Researchers reported that **KBOT** is an active Windows file-infector that spreads by injecting polymorphic malicious code into `EXE` and `DLL` files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels. The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining **file infection, financial theft, stealthy persistence, and attacker-controlled administration** in a single threat.
Aug 14, 2026