Loading story…
DiamondFox was marketed on underground forums as a modular malware-as-a-service platform that lowered the barrier to entry for cybercriminals by bundling espionage, credential theft, cryptocurrency wallet theft, self-propagation, and DDoS functions into a plugin-driven botnet. Check Point linked the offering to a seller using the alias "Edbitss", who advertised the malware on both clear-web and darknet forums, provided updates and customer support, and operated a management panel that let buyers track infections and control plugins across compromised hosts.
Technical analysis of the Crystal variant showed the malware installing itself as explorer.exe in the Windows Startup folder, dropping a hidden copy, creating autorun Registry entries for persistence, and attempting to reach command-and-control endpoints such as gate.php. Researchers found the examined sample’s main C2 offline, but spot checks of broader indicators revealed active DiamondFox panels and installers in the wild, suggesting use by multiple operators; the newer build also introduced a different packer, additional persistence keys, a domain generation algorithm, and an improved cryptocurrency wallet stealer.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository named "Diamondfox-Technical-Analysis-Report" showed a PDF titled "DİAMONDFOX Technical Analysis Report.PDF" uploaded with the commit message "Add files via upload." The visible page exposed repository metadata but not the report's technical contents.
A DiamondFox Crystal sample analyzed by researchers carried a compile timestamp of 2016-06-02 19:59:10. The sample was a Visual Basic binary with anti-reversing disabled.
Researchers found that the DiamondFox seller established a clear-web landing page on a blogspot.mx domain in March 2016. The page was cited as one indicator that the operator might have been located in Mexico despite claims of being in Russia.
Check Point reported that DiamondFox was being sold as a modular malware-as-a-service offering by a vendor using the alias "Edbitss." The report detailed its plugin-based capabilities for espionage, credential theft, wallet theft, self-propagation, and DDoS, and said Check Point products detected known variants and blocked C2 communications.
An analysis described DiamondFox Crystal's persistence, packing changes, domain generation algorithm, and improved cryptocurrency wallet stealer. It also noted that the examined sample's primary command-and-control server was inactive at the time of analysis.
During analysis, researchers found a small number of active DiamondFox-related panels and installers while spot-checking a larger IOC list of more than 600 entries. This indicated the malware was in active use by multiple operators even though many listed panels were dead or removed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceblog.checkpoint.com
Open sourcescmagazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
PurpleFox operators have continued to evolve a modular Windows malware platform that combines downloader, backdoor, and botnet capabilities with rootkit-based stealth and persistence. Researchers and CERT-UA linked the threat to campaigns using **trojanized MSI and software installers**, **PowerShell-based fileless chains**, **WPAD abuse**, and exploit-driven propagation, with infections observed from Indonesia and the Middle East to a large outbreak in Ukraine that affected at least 2,000 systems. The malware has also been seen spreading through known vulnerability exploitation and password brute-forcing, while operators rotated through extensive command-and-control infrastructure, including hundreds of intermediate control servers. Recent PurpleFox activity added a **FatalRAT-derived payload** and the **FoxSocket** .NET backdoor, which uses encrypted WebSocket communications for command and control and supports reconnaissance, file theft, process execution, and payload delivery. Trend Micro reported that staged installers disguised as Telegram, WhatsApp, Adobe, and Chrome fetched different second-stage payloads based on filename markers, while signed or revoked code-signing certificates were used to load malicious kernel drivers and disable security tooling such as file system mini-filter drivers. Across multiple campaigns, PurpleFox has exploited vulnerabilities including `CVE-2021-1732`, `CVE-2020-1054`, `CVE-2019-1367`, `CVE-2018-8120`, and `MS15-051`, underscoring its shift from exploit-kit delivery to a broader, adaptable intrusion and malware-distribution ecosystem.
Aug 15, 2026