Loading story…
Attackers ran a multi-stage information-stealing campaign against victims in Latin America and Asia Pacific by distributing password-protected archives disguised as pirated software. Trellix reported that the infection chain abused legitimate Cisco Webex binaries for DLL sideloading, which launched HijackLoader and then Vidar Stealer through an AutoIt3 component, enabling theft of browser credentials and communication with command-and-control infrastructure.
The campaign used several defense-evasion and post-compromise techniques, including a COM-based UAC bypass, adding Windows Defender exclusions, and injecting into MSBuild.exe. Trellix said the malware also fetched additional payloads and ultimately launched a cryptominer via AddInProcess.exe, describing the operation as a fresh and evasive threat with low detections in threat feeds despite clear execution-chain visibility in EDR telemetry.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
Another payload launched cmd.exe, explorer.exe, and a PowerShell script named 1_obf.ps1, which created and executed cXVgMt7JM.pif. That file introduced a legitimate VMwareHostOpen.exe alongside a malicious vmtools.dll for an additional DLL sideloading stage.
MSBuild.exe spawned AddInProcess.exe with command-line arguments consistent with a NEXA cryptominer. Trellix described this as resource hijacking through cryptomining activity.
After privilege escalation, the malware added itself to Windows Defender's exclusion list using Add-MpPreference -ExclusionPath. One payload then launched and injected into MSBuild.exe, which connected to 185[.]172.128.87 over port 80.
The malware downloaded additional PE payloads into C:\ProgramData and used CoGetObject with the COM Elevation Moniker and CMSTPLUA interface to bypass UAC. This caused payload execution as a child of DllHost.exe with elevated integrity.
The AutoIt3 component accessed credential-related files from Google Chrome, Mozilla Firefox, and Zoom-related files. Trellix assessed this activity as credential and data theft followed by exfiltration to command-and-control infrastructure.
HijackLoader downloaded and executed an AutoIt3 binary named GraphicsFillRect.au3, which Trellix identified as part of the Vidar Stealer infection chain. The component maintained network connections to 78[.]47.78.87, linked in the report to Vidar botnet infrastructure.
The Setup.exe file was a trojanized copy of Cisco Webex Meetings App Service ptService.exe that sideloaded a malicious wbxtrace.dll. Trellix identified the initial malicious loader as HijackLoader, which injected into more.com for execution and evasion.
The campaign used password-protected archive files disguised as free or pirated commercial software, with filenames embedding the password. Victims initiated the infection by extracting and running Setup.exe from the archive.
Trellix Advanced Research Center identified a multi-stage information-stealing campaign in March 2024 through high-confidence detections in Trellix EDR telemetry. The activity targeted customers in Latin America and Asia Pacific.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026