Loading story…
Threat actors exploited CVE-2023-36025, a Microsoft Windows Defender SmartScreen bypass vulnerability, to deliver the Phemedrone Stealer through malicious .url Internet Shortcut files hosted on services including Discord and FileTransfer.io. The infection chain downloaded a .cpl payload, abused control.exe and rundll32.exe to evade defenses, then retrieved additional PowerShell stages and a ZIP archive from GitHub. Microsoft patched the flaw in November 2023, and CISA later added it to the Known Exploited Vulnerabilities (KEV) catalog after in-the-wild abuse was confirmed.
The malware established persistence through DLL sideloading and a scheduled task, decrypted a second-stage loader from an RC4-encrypted file, and used the Donut in-memory loader to run the final .NET stealer payload. Phemedrone collected browser credentials, cryptocurrency wallet files, Discord and Telegram data, FileZilla credentials, Steam-related files, screenshots, and detailed host information, then validated and exfiltrated the stolen data primarily through the Telegram API. The campaign also aligned with MITRE ATT&CK T1218.002, reflecting the use of signed Windows binaries such as control.exe for system binary proxy execution.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft patched CVE-2023-36025, a Windows Defender SmartScreen bypass vulnerability involving insufficient checks and prompts on Internet Shortcut (.url) files. The flaw was later linked to malware delivery in the wild.
Trend Micro published research detailing how the campaign abused control.exe, rundll32.exe, PowerShell, GitHub-hosted stages, RC4 decryption, and the Donut in-memory loader to execute Phemedrone. The report also described data theft targets and exfiltration through the Telegram API.
Trend Micro documented an active campaign in which attackers used malicious .url files hosted on services including Discord and FileTransfer.io to exploit CVE-2023-36025 and bypass SmartScreen protections. The infection chain led to staged payload downloads, persistence via DLL sideloading and a scheduled task, and final deployment of the Phemedrone Stealer malware.
CISA added CVE-2023-36025 to its Known Exploited Vulnerabilities catalog based on evidence of in-the-wild exploitation. The reference does not provide a specific date for this action.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Phishing emails and malicious websites were used to trick users into launching **PowerShell**-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed `msedge.exe` spawning `powershell.exe`, followed by `curl.exe`, a downloaded DLL, and `rundll32.exe`; the decoded Base64 command used an `IEX` and `Net.WebClient.DownloadString` pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an **AgentTesla** variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download. A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of `updater.exe`, a packed PyInstaller-based **DXI Infostealer** sample. The malware used a **UAC bypass** via the `ms-settings` registry hijack and `computerdefaults.exe`, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with `rar.exe` before exfiltrating them through the **Telegram API** as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.
Jun 29, 2026
Threat actors used fake Facebook job advertisements and impersonation content, including lures themed around Amazon CEO Andy Jassy and DocuSign, to distribute the Windows information stealer **Ov3r_Stealer**. Trustwave SpiderLabs found victims were redirected to Discord-hosted `.url` shortcut files and, in some cases, weaponized PDFs, which triggered a multi-stage infection chain involving `control.exe`, malicious `.cpl` loaders, PowerShell scripts fetched from GitHub, and a final DLL sideloading payload delivered from a remote SMB share. Once installed, **Ov3r_Stealer** established persistence through scheduled tasks running every 90 minutes and harvested browser credentials, crypto wallets, FTP and Discord data, documents, and system information before exfiltrating the data to attacker-controlled Telegram bots and channels. Researchers said the malware was under active development, with alternate delivery methods including HTML smuggling, SVG smuggling, and LNK masquerading, and noted strong similarities to the open-source **Phemedrone Stealer**; the activity was linked to aliases including **Liu Kong**, **John Macollan**, **MR Meta**, and **MeoBlackA**, with indications the operator may be offering the malware as a service.
Aug 14, 2026
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026