Loading story…
A COVID-19-themed malware campaign used a fake WiseCleaner download site at wisecleaner[.]best to deliver a loader named WSHSetup.exe, which fetched both CoronaVirus ransomware and the Kpot information stealer from trynda[.]xyz and related domains. Researchers reported that Kpot executed first, harvesting credentials and other sensitive data from browsers, VPN, RDP, email, chat, FTP, and cryptocurrency wallets before contacting attacker-controlled infrastructure and deleting itself, indicating that data theft was a primary objective of the intrusion.
CoronaVirus ransomware then encrypted files with AES, appended the prefix coronavi2022@protonmail.ch___ to filenames, dropped a ransom note named CoronaVirus.txt, and demanded a relatively small Bitcoin payment via contact address coronaVi2022@protonmail.ch. The malware also modified the MBR, registered pre-boot execution through the BootExecute registry value, displayed lock-screen ransom messages before Windows loaded, and attempted to hinder recovery by deleting shadow copies and backups, leading analysts to assess that the ransomware likely served in part as cover for the broader Kpot credential-theft operation.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
MBSD published an analysis detailing how WSHSetup.exe delivered Kpot as file1.exe and CoronaVirus ransomware as file2.exe, along with the malware's credential theft and MBR/BootExecute behavior. The report also assessed that the ransomware may have helped conceal the information-stealing activity.
The fake WiseCleaner site used in the campaign became inaccessible after late March. This marked the apparent end of availability for that observed distribution point.
Researchers reported that the fake WiseCleaner download site at wisecleaner[.]best existed by at least late February and was used to distribute the fake installer WSHSetup.exe. That installer downloaded Kpot stealer and CoronaVirus ransomware from trynda[.]xyz.
The CoronaVirus ransomware campaign was active around the beginning of March 2020. Analysis indicated the operation paired a COVID-19-themed ransomware payload with the Kpot information stealer, suggesting credential theft was a primary objective.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors widely exploited COVID-19 news, relief programs, testing, and vaccine demand to increase the effectiveness of phishing and malware campaigns, while mostly reusing established malware and infrastructure. Microsoft reported an eleven-fold jump in COVID-19-themed attacks after the disease was formally named, but said these campaigns remained a small share of overall activity and largely repurposed existing tradecraft. Palo Alto Networks tracked **69,950** pandemic-related phishing URLs from early 2020 through early 2021, including a **530%** rise in vaccine-themed phishing and a **189%** increase in pharmacy- and hospital-related lures, with many pages harvesting Microsoft 365, Outlook, and webmail credentials or personal and financial data from newly created and compromised sites. The same social-engineering theme was used to deliver a broad mix of malware across desktop and mobile platforms. Researchers linked COVID-19 spam and fake sites to loaders and commodity malware including **GuLoader**, **Parallax RAT**, **Remcos**, **Agent Tesla**, **NanoCore**, **NetWire**, **AzorUlt**, **FormBook**, **TrickBot**, and **MetaMorfo**, often relying on malicious attachments, macro-enabled Office files, or exploits such as `CVE-2017-11882`; Microsoft and others warned users not to enable macros in untrusted documents. More disruptive campaigns included **Netwalker** ransomware delivered through a `CORONAVIRUS_COVID-19.vbs` attachment, Android fraud via the **Ginp** trojan’s fake “Coronavirus Finder,” an Android **SLocker** variant that locked devices with COVID-19-themed ransom messages, and later low-volume phishing that used WHO-themed documents to install **Nerbian RAT** with anti-analysis and persistence features.
Aug 15, 2026
Threat researchers reported multiple **COVID-19-themed phishing campaigns** distributing the **RedLine Stealer** malware by disguising payloads as legitimate pandemic-related software and information. In one campaign, attackers used an `Omicron Stats.exe` lure tied to the Omicron outbreak; in another, they impersonated a coronavirus research effort and pushed a fake **Folding@home** application named `foldingathomeapp.exe`. Researchers assessed email as the likely delivery vector, with the campaigns exploiting public anxiety and curiosity around the pandemic to drive downloads. Once executed, RedLine harvested **browser credentials, cookies, credit card and autocomplete data, cryptocurrency wallet artifacts, Telegram and Discord data, and detailed host information**. Fortinet said the Omicron-themed sample copied itself into the victim’s roaming `AppData` directory, established persistence through a scheduled task, and communicated with a command-and-control server at `207.32.217.89:14588` using a distinctive authorization header; Proofpoint and BleepingComputer also noted RedLine receives remote tasking after infection. Victims were observed across at least **12 countries**, indicating broad opportunistic targeting rather than a narrowly focused operation.
Aug 15, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026