Loading story…
Researchers reported that the Jupyter infostealer—also tracked as SolarMarker and linked to the Mars/Deimos code lineage—adopted a more evasive delivery chain using oversized .msi installers built with Advanced Installer. In observed attacks, msiexec.exe launched PowerShell, dropped a decoy installer such as Nitro Pro 13 or SumatraPDF, and then executed a Jupyter loader designed to avoid detection. The malware family, a .NET-based infostealer and backdoor first identified in 2020, is known for stealing browser data while maintaining remote access on compromised systems.
The PowerShell stage wrote an encoded payload into the user AppData path, decoded it with XOR, and reflectively loaded a .NET DLL that executed under the Deimos namespace in the Mars class. The malware then established persistence through registry keys and a Startup shortcut. Multiple variants tracked as SP-9 through SP-16 reportedly had extremely low or zero VirusTotal detections at the time they were submitted, underscoring the campaign's stealth. Some samples were also signed with certificates tied to legitimate businesses, raising concerns about certificate theft or impersonation, while published indicators included hashes, command-and-control IP addresses, and lure filenames.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
The SP-14 and SP-16 Jupyter DLL variants were first submitted to VirusTotal on 2021-09-21. Several of the campaign's variants had zero malicious detections at the time referenced.
The SP-13 Jupyter DLL variant was first submitted to VirusTotal on 2021-09-13 as another sample in the evolving Jupyter campaign.
The SP-11 Jupyter DLL variant was first submitted to VirusTotal on 2021-09-10, continuing the appearance of low-detection samples tied to the campaign.
The SP-9 and SP-10 Jupyter DLL variants were first submitted to VirusTotal on 2021-09-08. At the time referenced, they had very low detection rates, with SP-9 at 1/57 and SP-10 at 2/57.
On 2021-09-08, Morphisec identified a new Jupyter delivery chain using oversized MSI installers generated with Advanced Installer to launch PowerShell via msiexec.exe, drop decoy software, and execute an evasive loader. The campaign was described as threatening multiple high-level targets.
A May 2021 public analysis of the Mars-Deimos-RS-2 malware described its obfuscated PowerShell persistence chain, in-memory .NET loading, and the solarmarker.dat host-identifier artifact. The author also linked the malware to CrowdStrike's SolarMarker reporting and said it shared indicators and functionality with Morphisec's Jupyter infostealer.
Morphisec first introduced Jupyter in 2020 as a .NET malware family that steals browser data and also provides backdoor capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Phishing emails and malicious websites were used to trick users into launching **PowerShell**-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed `msedge.exe` spawning `powershell.exe`, followed by `curl.exe`, a downloaded DLL, and `rundll32.exe`; the decoded Base64 command used an `IEX` and `Net.WebClient.DownloadString` pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an **AgentTesla** variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download. A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of `updater.exe`, a packed PyInstaller-based **DXI Infostealer** sample. The malware used a **UAC bypass** via the `ms-settings` registry hijack and `computerdefaults.exe`, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with `rar.exe` before exfiltrating them through the **Telegram API** as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.
Jun 29, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026