Loading story…
Check Point Research reported a large-scale phishing operation distributing Rhadamanthys stealer version 0.7 through copyright-infringement lures. Since at least July 2024, the campaign has impersonated dozens of companies—especially in entertainment, media, and software—and sent tailored emails from unique Gmail accounts to targets across the United States, Europe, the Middle East, East Asia, and South America. The messages pressure recipients to review alleged intellectual-property violations and download password-protected archives, giving the operation broad reach while preserving a spear-phishing appearance.
The infection chain uses DLL sideloading with legitimate executables to install the malware, establish persistence, and connect to command-and-control infrastructure before fetching additional modules. Researchers said the latest build includes a new OCR-related component marketed as AI-powered, but analysis indicates it relies on older OCR-style machine-learning techniques and is likely intended to identify BIP39 cryptocurrency wallet seed phrases in images and documents. Check Point assessed that the operation is more consistent with a financially motivated cybercrime group than a nation-state actor because of its automated infrastructure and indiscriminate targeting.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point said the CopyRh(ight)adamantys campaign has been active since July 2024, using copyright-infringement themed phishing emails to deliver Rhadamanthys stealer 0.7 to targets across multiple regions.
Israel's National Cyber Directorate issued an urgent alert that an Iranian attack group had carried out a targeted phishing campaign impersonating F5.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 130 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourcegov.il
Open sourceservices.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rhadamanthys, a prominent information-stealing malware, has undergone significant evolution, expanding its capabilities and threat profile. Initially promoted on cybercrime forums by a threat actor known as kingcrete2022, Rhadamanthys has become a leading malware-as-a-service (MaaS) offering, rivaling other popular stealers such as Lumma, Vidar, StealC, and Acreed. The malware's latest version, 0.9.2, introduces advanced features including device and web browser fingerprinting, as well as the use of PNG steganography for payload delivery, enhancing its ability to evade detection and exfiltrate sensitive data. Previous updates, such as version 0.7.0, incorporated artificial intelligence-based optical character recognition (OCR) to capture cryptocurrency wallet seed phrases, demonstrating the developers' commitment to integrating cutting-edge techniques. The operators have rebranded as "RHAD security" and "Mythical Origin Labs," marketing Rhadamanthys as an "intelligent solution" and offering it in tiered packages ranging from $299 to $499 per month, with an enterprise option available for direct negotiation. This business-like approach, including a structured product portfolio and customer support, signals a long-term strategy to maintain and grow their presence in the cybercrime ecosystem. The stealer is distributed through various channels, including fake software and phishing campaigns, targeting both individuals and organizations. Its modular architecture allows for rapid adaptation to new security measures, making it a persistent threat. Security researchers have observed that Rhadamanthys is frequently updated, with new features aimed at bypassing modern defenses and increasing the value proposition for cybercriminal customers. The malware's ability to collect a wide range of credentials, financial information, and system data poses significant risks to both personal and corporate security. Defensive measures must account for its evolving tactics, including the use of steganography and AI-driven data extraction. The growing sophistication and commercialization of Rhadamanthys reflect broader trends in the cybercrime-as-a-service market, where threat actors continuously innovate to outpace defenders. Organizations are urged to implement robust endpoint protection, monitor for indicators of compromise, and educate users about the risks of downloading software from untrusted sources. The ongoing development and aggressive marketing of Rhadamanthys underscore the need for continuous vigilance and adaptive security strategies in the face of rapidly evolving malware threats.
Jun 29, 2026
A Vietnamese cybercriminal group known as Lone None has orchestrated a sophisticated phishing campaign that leverages fake copyright infringement notices to target individuals and organizations globally. The campaign, active since at least November 2024, begins with emails purporting to be from legitimate law firms, demanding the removal of allegedly infringing content from the recipient’s website or social media accounts. These emails are highly convincing, often referencing the recipient’s real online profiles and are translated into at least ten languages, including English, French, German, and Chinese, indicating a broad international targeting strategy. The phishing messages contain links that direct victims to download compressed archives, such as ZIP files, which masquerade as legal evidence documents in formats like PDF or PNG. Upon extraction, these archives contain malware that is executed using DLL side-loading, a technique that abuses trusted, signed applications—such as Microsoft Word or PDF readers—to bypass security controls and run malicious code undetected. The campaign delivers two primary types of information-stealing malware: Pure Logs Stealer and the more recent Lone None Stealer, also known as PXA Stealer. Pure Logs Stealer is designed to harvest a wide array of sensitive data, including passwords, credit card details, session cookies, and cryptocurrency wallet files stored on the victim’s device. The Lone None Stealer, first tracked by Cofense Intelligence in June 2025, is specifically engineered to target cryptocurrency assets. It monitors the victim’s clipboard for copied crypto wallet addresses and surreptitiously replaces them with addresses controlled by the attackers, thereby redirecting any intended cryptocurrency transfers. The campaign’s technical sophistication is further demonstrated by its use of Telegram bot profile pages for initial payload delivery and the deployment of obfuscated, compiled Python scripts to evade detection. Cofense Intelligence has observed that Lone None Stealer has appeared in 29% of all active threat reports involving Pure Logs Stealer since June 2025, highlighting its growing prevalence. The attackers also employ machine translation or AI tools to generate new email templates, allowing them to rapidly adapt and expand their reach. To further evade analysis and detection, the campaign abuses legitimate software such as Haihaisoft, leveraging their signed binaries for malicious purposes. The ongoing evolution of the campaign’s tactics, techniques, and procedures (TTPs) demonstrates a high level of operational agility and technical capability. The campaign’s focus on both personal and financial data, with a particular emphasis on cryptocurrency theft, poses significant risks to individuals and organizations alike. Security researchers recommend heightened vigilance for unsolicited legal notices, especially those containing download links or attachments, and advise organizations to implement robust email filtering and endpoint protection measures. The use of legitimate-looking legal threats and multi-language support increases the likelihood of successful social engineering, making this campaign particularly dangerous for a global audience. The campaign’s reliance on trusted software for malware execution underscores the importance of monitoring for unusual process behaviors and regularly updating security controls to detect DLL side-loading techniques. Organizations are urged to educate employees about the risks of phishing emails and to verify the authenticity of any legal correspondence received via email.
Jun 29, 2026
Rhadamanthys emerged as a fast-growing malware-as-a-service infostealer sold on criminal forums, using aggressive promotion and frequent updates to attract operators. Researchers found it delivered through lures including fake AnyDesk installers and malicious Google Ads, then executed through a multi-stage chain involving packed droppers, shellcode, custom loaders, VM-evasion, API unhooking, and obfuscated command-and-control retrieval. The malware was observed attempting infections beyond broad consumer targeting, including a Canadian government agency and an Indian energy company, while generally avoiding CIS targets. Technical analysis showed Rhadamanthys stealing credentials, cookies, browser data, and information from password managers, VPNs, messaging apps, email clients, FTP tools, gaming platforms, and cryptocurrency wallets. Later versions, including `v0.5.0`, added a plugin architecture, keylogging, spyware-like data collection, Lua and .NET extensions, process injection, raw and indirect syscalls, Heaven’s Gate, and ETW/AMSI bypasses, allowing operators to fetch and run additional modules from C2 infrastructure. Researchers also reconstructed its final payload behavior from memory artifacts, showing how the malware parses Chrome SQL and JSON stores and executes downloaded components via `rundll32` to broaden theft and post-compromise capability.
Aug 15, 2026