Loading story…
Researchers reported sustained JsOutProx malware operations targeting financial institutions, government bodies, and related customers across India, wider Asia, and the MENA region. The activity relied on spearphishing emails impersonating trusted organizations such as SWIFT, MoneyGram, central banks, and Indian financial agencies, with lures tied to compliance, anti-money laundering, COVID-19 notices, and sector-specific programs such as the Kisan Credit Card scheme. Victims were sent ZIP archives posing as PDFs, images, or office files that contained malicious HTA, JavaScript, or Java payloads, including incidents affecting Indian banks and a later campaign impacting customers of a major Saudi bank.
The malware family used heavily obfuscated, multi-stage loaders executed through mshta or script hosts, then established persistence and contacted Dynamic DNS command-and-control infrastructure. Multiple reports describe a modular toolset capable of command execution, file theft and management, screenshot capture, clipboard and Outlook data theft, proxy and DNS manipulation, privilege escalation, and in newer variants, in-memory execution of .NET assemblies; some samples also used cookie-based HTTP communications carrying encoded victim profiling data. Researchers linked the activity to long-running campaigns against Indian co-operative banks and finance companies, observed infrastructure shifts from GitHub to GitLab for payload hosting, and noted overlaps with other malware operations while attribution remained cautious.
Get the infrastructure and lures behind it.
12 events from the most recent confirmed update back to the earliest known activity.
On March 27, 2024, Resecurity identified a new malware sample from the same group that switched the infection chain from GitHub-hosted payloads to GitLab-hosted payloads.
Around March 25, 2024, the actor behind the campaign registered multiple GitLab accounts and used repositories such as dox05 and docs909 to host malicious payloads.
Around February 8, 2024, Resecurity identified a spike in activity tied to a campaign targeting customers of a major regional bank in Saudi Arabia, as reported by a major system integrator.
Independent cybersecurity researchers had reported some payloads associated with the later APAC and MENA JSOutProx activity as early as November 14, 2023.
Quick Heal said it had been observing JSOutProx attacks against Indian co-operative banks and finance companies since early 2021.
Zscaler reported a JsOutProx campaign in May 2020 targeting governmental and financial institutions in India.
Quick Heal observed a renewed Adwind Java RAT campaign in April 2020 using COVID-19- and banking-themed spearphishing emails against co-operative banks in India.
In April 2020, attackers targeted NABARD, the Reserve Bank of India, IDBI Bank, and Agriculture Insurance Company of India with phishing emails carrying archive attachments containing JsOutProx-linked HTA payloads or a Java backdoor.
Seqrite reported the command-and-control domain used in a renewed Adwind Java RAT campaign against Indian co-operative banks was active from 05-Apr-2020 to 20-Apr-2020.
Quick Heal reported monitoring a JSOutProx campaign targeting Indian co-operative banks and finance companies since at least December 2019.
JsOutProx was first discovered in December 2019, marking the earliest known identification of the malware family later used in multiple phishing campaigns.
FortiGuard Labs discovered a spearphishing campaign targeting governmental, monetary, and financial-sector organizations in Asia using central-bank-themed lures to deliver JsOutProx.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 129 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
7 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourceresecurity.com
Open sourcezscaler.com
Open sourceblogs.quickheal.com
Open sourcefortinet.com
Open sourceseqrite.com
Open sourceseqrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
JPCERT/CC reported that **APT-C-60** continued targeting organizations in Japan with spear-phishing campaigns that shifted initial access tactics while retaining heavy abuse of legitimate online services. In observed intrusions, phishing emails either linked victims to **Proton Drive** or carried malicious archive attachments, including RAR files containing **`.lnk`** shortcuts. When opened, the LNK files launched **`mshta.exe`** to execute embedded JavaScript, beginning a multi-stage infection chain designed to blend into normal enterprise traffic. The JavaScript retrieved and decoded additional components from services including **jsDelivr**, then used a legitimate **`git.exe`** binary to run scripts and assemble downloaders from **`.db`** files before fetching more payloads from **GitHub**, **GitLab**, **Codeberg**, and other trusted platforms. JPCERT/CC said the final malware delivered was **SpyGlace**, with versions **v3.1.15**, **v3.1.17**, and **v3.1.18** observed, and published related indicators including C2 infrastructure, malicious file hashes, phishing sender addresses, and attacker repository details. The agency noted that combining standard Windows tools with trusted cloud, developer, and CDN services makes the activity harder to detect.
Jul 18, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026