Loading story…
Threat actors distributed a trojanized Windscribe VPN installer that paired the legitimate application with malicious components to covertly infect Windows systems. The package dropped the real VPN installer alongside a malicious executable, lscm.exe, and a VBS launcher, win.vbs, so the visible software installation could conceal background malware activity. Trend Micro reported that the installer was obtained from fraudulent sources rather than Windscribe’s official download channels or legitimate app stores.
During execution, the malware retrieved an encrypted payload named Dracula.jpg, passed it through multiple layers of obfuscation and decryption, and installed Backdoor.MSIL.BLADABINDI.THA. The backdoor gave attackers the ability to download, execute, and update files, capture screenshots, and collect host details including the machine name, operating system, username, and installed antivirus products, providing broad remote access and reconnaissance capability on compromised hosts.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that threat actors were distributing a bundled Windscribe VPN installer from fraudulent sources that also dropped malicious files, including lscm.exe and win.vbs, to install a BLADABINDI backdoor. The report also published technical details and indicators of compromise for the payload delivery chain, including Dracula.jpg and related infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious spam campaign delivered **BazarLoader** by abusing the Windows 10 **App Installer** mechanism through links using the `ms-appinstaller` URI scheme. The operation used personalized complaint-themed lures and hosted malicious `.appinstaller` and `.appxbundle` files on Microsoft cloud storage, presenting victims with a fake Adobe-branded installer signed with a certificate linked to **Systems Accounting Limited** while falsely displaying **Adobe Inc.** as the publisher. After installation, the payload `SecurityFix.exe` downloaded and executed a DLL via `regsvr32.exe`, used delayed execution and process spawning to evade detection, and injected into a headless `msedge.exe` process to start command-and-control traffic. Sophos said the malware matched **BazarBackdoor** behavior, including HTTPS cookie-based C2, PowerShell and native-command system profiling, and checks of external services to identify the victim network’s public IP address; Microsoft later tracked the App Installer issue as **CVE-2021-43890** and fixed it in a subsequent Patch Tuesday release.
Jun 29, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026
Microsoft reported a multi-stage malware campaign that used **WhatsApp messages** to trick targets into opening malicious **Visual Basic Script** (`.vbs`) files. The activity, observed from late February 2026, relied on social engineering and trusted cloud infrastructure including **AWS S3**, **Tencent Cloud**, and **Backblaze B2** to host follow-on payloads. After execution, the malware created hidden folders under `ProgramData`, downloaded additional VBS components, and used renamed legitimate Windows utilities to blend into normal system activity. The intrusion chain then attempted **UAC bypass**, registry changes for persistence, and deployment of unsigned MSI installers including `Setup.msi`, `WinRAR.msi`, `LinkPoint.msi`, and `AnyDesk.msi`, which provided remote access and backdoor capability on compromised systems. Microsoft said the attackers abused living-off-the-land techniques such as renaming `curl.exe` and `bitsadmin.exe` while leaving original PE metadata intact, giving defenders a detection opportunity; the company also linked the activity to command-and-control domains **`neescil.top`** and **`velthora.top`** and published indicators, file hashes, and hunting guidance for defenders.
Jun 29, 2026