Loading story…
Threat actors used fake Facebook job advertisements and impersonation content, including lures themed around Amazon CEO Andy Jassy and DocuSign, to distribute the Windows information stealer Ov3r_Stealer. Trustwave SpiderLabs found victims were redirected to Discord-hosted .url shortcut files and, in some cases, weaponized PDFs, which triggered a multi-stage infection chain involving control.exe, malicious .cpl loaders, PowerShell scripts fetched from GitHub, and a final DLL sideloading payload delivered from a remote SMB share.
Once installed, Ov3r_Stealer established persistence through scheduled tasks running every 90 minutes and harvested browser credentials, crypto wallets, FTP and Discord data, documents, and system information before exfiltrating the data to attacker-controlled Telegram bots and channels. Researchers said the malware was under active development, with alternate delivery methods including HTML smuggling, SVG smuggling, and LNK masquerading, and noted strong similarities to the open-source Phemedrone Stealer; the activity was linked to aliases including Liu Kong, John Macollan, MR Meta, and MeoBlackA, with indications the operator may be offering the malware as a service.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Trustwave SpiderLabs identified a previously unreported Windows information-stealing malware family named Ov3r_Stealer during an Advanced Continual Threat Hunt campaign investigation. The discovery was explicitly said to have occurred in early December.
Researchers reported strong similarities and code-level overlaps between Ov3r_Stealer and the open-source Phemedrone Stealer, suggesting Phemedrone may have been repurposed and renamed. They also noted the delivery chain closely resembled one previously used for Phemedrone.
Trustwave associated the campaign with aliases including John Macollan, Liu Kong, MR Meta, and MeoBlackA, tying them to Telegram groups and forums. Reporting also said Liu Kong appeared to be promoting the malware as part of a malware-as-a-service operation.
Trustwave observed additional loader variants for Ov3r_Stealer using HTML smuggling, SVG smuggling, and LNK shortcut masquerading. One SVG-based chain exploited WinRAR code execution vulnerability CVE-2023-38831 to deliver a malicious LNK file.
Threat actors distributed Ov3r_Stealer through fake Facebook job advertisements and impersonation content, including a lure impersonating Amazon CEO Andy Jassy. The infection chain used a weaponized PDF, a Discord-hosted .url file disguised as a DocuSign document, a malicious CPL loader, and a PowerShell script from GitHub.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors exploited **`CVE-2023-36025`**, a Microsoft Windows Defender SmartScreen bypass vulnerability, to deliver the **Phemedrone Stealer** through malicious `.url` Internet Shortcut files hosted on services including Discord and FileTransfer.io. The infection chain downloaded a `.cpl` payload, abused **`control.exe`** and **`rundll32.exe`** to evade defenses, then retrieved additional PowerShell stages and a ZIP archive from GitHub. Microsoft patched the flaw in November 2023, and CISA later added it to the **Known Exploited Vulnerabilities (KEV)** catalog after in-the-wild abuse was confirmed. The malware established persistence through DLL sideloading and a scheduled task, decrypted a second-stage loader from an RC4-encrypted file, and used the **Donut** in-memory loader to run the final .NET stealer payload. Phemedrone collected browser credentials, cryptocurrency wallet files, Discord and Telegram data, FileZilla credentials, Steam-related files, screenshots, and detailed host information, then validated and exfiltrated the stolen data primarily through the Telegram API. The campaign also aligned with **MITRE ATT&CK `T1218.002`**, reflecting the use of signed Windows binaries such as `control.exe` for system binary proxy execution.
Aug 14, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026