Loading story…
Threat actors linked to Russia used fake cryptocurrency job offers to target people in Eastern Europe with Enigma Stealer, a modified version of the open-source Stealerium infostealer. The campaign relied on a multi-stage infection chain with custom obfuscated loaders and Telegram-based payload delivery and command handling, while a debug and logging server was identified at 193[.]56[.]146[.]29.
After infection, the malware used a bring-your-own-vulnerable-driver technique to exploit Intel driver flaw CVE-2015-2291, loading a malicious driver that lowered Microsoft Defender’s token integrity and effectively disabled its protections without terminating the process. The final payload harvested browser data, credentials, tokens, screenshots, clipboard contents, and VPN configurations, then exfiltrated the stolen information to the operators through Telegram.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Trend Micro publicly reported on the Enigma Stealer operation, describing the fake-job lure chain, Telegram-based infrastructure, and the use of a vulnerable Intel driver to impair Microsoft Defender. The report assessed the operators as likely Russian based on infrastructure characteristics and context.
The second-stage payload used a bring-your-own-vulnerable-driver technique exploiting Intel driver flaw CVE-2015-2291, dropping iqvw64.sys and a malicious Driver.sys and using KDMapper to load the unsigned driver. The malicious driver reduced the token integrity of Microsoft Defender's MsMpEng.exe process to effectively disable it without terminating the process.
A third-stage C# downloader executed after the Defender-disabling stage, sent a "Bot started" message to both the debug server and Telegram, and polled Telegram for commands such as stop, alive, and runassembly. It also downloaded the next payload component, including files observed as packed payload parts.
The disguised executable Interview conditions.word.exe acted as the first-stage Enigma loader, collecting host information, contacting Telegram to obtain the next payload, and launching the second-stage DLL UpdateTask.dll via rundll32.exe. It also attempted a UAC bypass and stored victim identifiers in the registry.
The campaign used Telegram for payload delivery, command handling, and heartbeat traffic, while a server at 193[.]56[.]146[.]29 registered newly infected hosts when the first-stage loader ran. Researchers also identified an Amadey C2 panel on that same server.
A malware campaign targeted Eastern Europeans working in or around the cryptocurrency industry using fake job-interview themed files, including a malicious archive named contract.rar. The operation delivered Enigma Stealer, a modified version of the open-source Stealerium infostealer, through a multi-stage infection chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors used fake Facebook job advertisements and impersonation content, including lures themed around Amazon CEO Andy Jassy and DocuSign, to distribute the Windows information stealer **Ov3r_Stealer**. Trustwave SpiderLabs found victims were redirected to Discord-hosted `.url` shortcut files and, in some cases, weaponized PDFs, which triggered a multi-stage infection chain involving `control.exe`, malicious `.cpl` loaders, PowerShell scripts fetched from GitHub, and a final DLL sideloading payload delivered from a remote SMB share. Once installed, **Ov3r_Stealer** established persistence through scheduled tasks running every 90 minutes and harvested browser credentials, crypto wallets, FTP and Discord data, documents, and system information before exfiltrating the data to attacker-controlled Telegram bots and channels. Researchers said the malware was under active development, with alternate delivery methods including HTML smuggling, SVG smuggling, and LNK masquerading, and noted strong similarities to the open-source **Phemedrone Stealer**; the activity was linked to aliases including **Liu Kong**, **John Macollan**, **MR Meta**, and **MeoBlackA**, with indications the operator may be offering the malware as a service.
Aug 14, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Researchers uncovered a newly identified malware-as-a-service operation called **Evil Stealer** after its backend infrastructure was left exposed on Njalla-hosted systems, including an unauthenticated status API on port `8888` and a raw Next.js panel on port `3000`. The exposed API revealed a sequential counter showing **310,194 processed credential logs** within roughly six days, while the panel’s JavaScript also contained a cryptocurrency wallet drainer. Investigators linked the operation to domains including `evilmirror[.]net` and `ofmhubintel[.]com`, the latter tied to an **OnlyFans creator scraper**, indicating the actor was pursuing multiple monetization streams beyond credential theft. The operator was identified with high confidence through poor operational security in a promotional video whose unstripped XMP metadata exposed the Windows username **"moros"**, a Russian-language filename, and timestamps consistent with **UTC+3 / Moscow time**. Additional artifacts, including Russian keyboard indicators, shared registrar and hosting details, matching SSH HASSH fingerprints, and common Ubuntu templates, supported the assessment that the same Russian-speaking actor ran the linked infrastructure. Researchers also observed nearby suspicious services on the same hosting environment, including phishing and TLS interception infrastructure, although attribution for those adjacent systems was weaker; the malware payload and delivery chain for Evil Stealer itself had not yet been publicly identified.
Jun 29, 2026