Loading story…
Researchers reported that PsiXBot, a modular .NET malware family first seen in 2017, matured into a more capable bot focused on credential theft, surveillance, and remote control. The malware was observed spreading through malspam, SmokeLoader, and the Spelevo Exploit Kit, then installing under %APPDATA%, avoiding systems configured for the Russian language, and using RC4-encrypted communications. Its feature set grew to include browser and Outlook credential theft, keylogging, form grabbing, clipboard cryptocurrency hijacking, remote desktop access, persistence, and download-and-execute functions delivered through separate modules.
Later analysis showed PsiXBot updating its command-and-control discovery to better support resilient Namecoin .bit domains, including the use of tiny[.]cc shortened links and hex-encoded values to retrieve DNS server IP addresses for resolving its infrastructure. The bot continued to collect host data, check in over encrypted HTTPS, and receive commands for tasks such as spam sending through Microsoft Outlook, scheduled execution, and additional foreground modules. The use of .bit domains aligns with broader concerns that decentralized naming systems can provide a form of bulletproof hosting that complicates takedowns and infrastructure disruption.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Fox-IT observed the Spelevo exploit kit distributing PsiXBot, documenting exploit-kit-based delivery of the malware.
Fox-IT observed SmokeLoader delivering a PsiXBot sample, showing the malware was being spread through loader-based distribution in addition to other vectors.
Fox-IT reported that by early 2019 PsiXBot had matured into a more capable modular bot with expanded core functionality and modules for credential theft, keylogging, remote access, persistence, and download-and-execute tasks.
Fox-IT noted an updated PsiXBot sample observed in August 2018, indicating ongoing development of the malware family before its later modular expansion.
Fox-IT reported that the modular .NET malware family PsiXBot was first observed in the wild in mid-2017.
Proofpoint identified newly implemented StartFGModule and StartSpam capabilities in PsiXBot 1.0.2, expanding the malware with form grabbing and outbound spam-sending through Microsoft Outlook.
Proofpoint reported that PsiXBot version 1.0.2 changed its command-and-control discovery method by using tiny[.]cc shortened URLs and hex-encoded values to retrieve DNS server IPs for resolving NameCoin .bit domains.
Proofpoint researchers observed a new PsiXBot version, 1.0.2, continuing to spread via malicious spam and exploit kit campaigns including Spleevo and RIG-v.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 74 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
proofpoint.com
Open sourceproofpoint.com
Open sourceblog.fox-it.com
Open sourceabuse.ch
Open sourcetools.ietf.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Phorpiex, also tracked as **Trik**, grew from an IRC-controlled Windows worm into a large modular botnet used to spread spam, sextortion emails, cryptocurrency miners, stealers, and ransomware. Early variants copied themselves into hidden directories, set **Run** key persistence, weakened host defenses by adding firewall exceptions and disabling Windows Defender, and accepted commands to download payloads, brute-force SMTP accounts, and mass-mail ZIP-packed malware. Researchers later tied the botnet to more than **1 million infected systems**, with infections observed across **160 countries**, and noted propagation through phishing, removable USB drives, instant messaging, fake software sites, and other malware. Later Phorpiex operations shifted from legacy IRC infrastructure toward HTTP, IP-based, and **DGA**-backed command-and-control centered on the **Tldr** loader, while retaining older spam and worming capabilities. The platform delivered secondary payloads including **XMRig**, **Raccoon Stealer**, **Predator The Thief**, **GandCrab**, **Avaddon**, **Nemty**, **Knot**, **Pony**, and other ransomware, and also used clipboard hijacking and data exfiltration for monetization. Check Point and Microsoft reported resilient infrastructure, including dedicated subnets and payload validation with **RC4** encryption plus **RSA-SHA1** signature checks, while a VNC worm module brute-forced exposed port `5900` systems and drove victims to download malware, underscoring Phorpiex's role as a durable criminal distribution service.
Aug 15, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers detailed how **Pikabot** has evolved into a heavily obfuscated malware loader and core backdoor that uses layered string protection, dynamic API resolution, anti-analysis checks, and stealthy process injection. Recent reverse-engineering shows Pikabot decrypts strings through per-string `RC4`, modified `Base64`, and `AES-CBC`, while newer tooling can now automate recovery of keys, IVs, and encrypted arrays from samples. Analysts said the malware disguises itself as **SearchProtocolHost.exe**, walks the PEB to locate `kernel32.dll`, hashes API names, and uses indirect syscalls such as `NtAllocateVirtualMemory`, `NtWriteVirtualMemory`, and `NtResumeThread` to inject its core module into a suspended legitimate process. The recovered functionality shows Pikabot can profile hosts, enumerate processes, execute commands, manipulate files and the registry, and communicate with command-and-control servers over **WinINet** using HTTP POST requests. Earlier loader samples also established persistence with a scheduled task and a registry-stored PowerShell downloader that fetched a DLL, decoded it from Base64, and launched it with `regsvr32`, while newer samples extracted payload components from PNG resources before decryption and injection. Reporting on distribution linked Pikabot to spam thread-hijacking campaigns, malicious attachments and links, and malvertising that impersonated **AnyDesk**, with operators using commands such as `whoami.exe /all`, `ipconfig.exe /all`, and `netstat.exe -aon` to survey compromised systems.
Aug 15, 2026