Loading story…
Attackers used fake cryptocurrency-themed websites to distribute SpyAgent, a malware loader that communicates with command-and-control servers using periodic HTTP GET requests containing a 9-digit victim ID and an environment hash derived from system values such as MachineGuid, Windows product name, username, and computer name. The malware also monitored keyboard and mouse inactivity, reporting when a victim became idle, how long the idle period lasted, and when activity resumed, giving operators visibility into when a compromised device was unattended.
The campaign appeared financially motivated and was geared toward credential theft, cryptocurrency wallet theft, and clipboard hijacking to replace wallet addresses during transactions. SpyAgent was used to fetch and run additional commodity malware, including RedLine Stealer, Ducky stealer, AZORult, Cypress Stealer, Clipper, Remcos RAT, NanoCore, njRAT, and AsyncRAT, expanding the operators’ ability to steal data, maintain access, and monetize infected systems.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro reported on a financially motivated malware campaign centered on SpyAgent that used fake cryptocurrency websites, malicious ads, and social media lures. The campaign was observed delivering additional stealers and RATs including RedLine, AZOrult, Remcos RAT, NanoCore, njRAT, and AsyncRAT, while also monitoring user idleness and communicating with C2 infrastructure.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors targeted cryptocurrency and NFT communities with phishing messages and spoofed NFT project websites that impersonated legitimate services to trick users into downloading malware. One campaign used a fake Pixelmon site, `pixelmon[.]pw`, to mimic the real project and deliver ZIP archives containing Windows shortcut and script payloads that installed **Vidar** infostealer, which steals passwords, cryptocurrency wallet data, and sensitive files. Researchers found Vidar obtained command-and-control details through a Telegram channel and could fetch additional modules from its C2 infrastructure. A separate but related campaign tracked as **NFT-001** used Discord and similar forums to lure victims to decoy crypto sites, where a malicious installer deployed **Remcos RAT** and, in newer variants, **Eternity Stealer**. Morphisec reported the operators changed tooling from the **Babadeda** crypter to a staged downloader while keeping similar delivery infrastructure and some overlapping C2 elements. The newer downloader performed a UAC bypass, added `C:\` to Microsoft Defender exclusions, and retrieved follow-on payloads to improve evasion and credential theft, showing continued refinement of malware delivery against NFT and crypto users.
Aug 15, 2026
Threat researchers reported two large malware distribution operations that relied on popular consumer lures rather than software exploits. One campaign used piracy sites offering movies, TV shows, books, and digital library content to push fake plugin or browser update prompts; the downloaded ZIP files abused DLL side-loading, ROP-based decryption, and reflective loading to install a modified `SilentCryptoMiner`, a watchdog, a RAT component, and CPU/GPU miners. The malware gated execution through DNS tunneling and date-generated command-and-control infrastructure, harvested host data, and established persistence with a fake `GoogleUpdateTaskMachineQC` service and repeated UAC elevation attempts, with implicated sites drawing roughly 40 million visits in a single month. A separate operation used `openew[.]app`, a fake ChatGPT download page impersonating OpenAI, to infect both Windows and macOS users with platform-specific malware. Windows visitors received a credential-stealing loader disguised as `Chat_GPT.exe`, built with Inno Setup and Electron and launching PowerShell activity that contacted `188.137.246.189`, while macOS users were served **Atomic Stealer (AMOS)** to steal passwords, browser data, Telegram sessions, and cryptocurrency wallet information. Researchers said the macOS payload also attempted to replace legitimate Ledger and Trezor applications with trojanized versions, underscoring a strong cryptocurrency theft motive and showing how attackers are exploiting AI-brand search traffic and piracy demand to scale malware infections.
Jun 29, 2026
Researchers and incident responders documented a targeted intrusion campaign by **CryptoMimic**—also tracked as **Dangerous Password**, **CageyChameleon**, and **Leery Turtle**—that focused on banks, financial organizations, and especially cryptocurrency businesses. The attacks used spear-phishing lures that delivered ZIP or RAR archives containing malicious `.lnk` shortcut files and decoy documents; when opened, the shortcuts launched `mshta.exe` to fetch remote HTML or VBScript payloads. JPCERT/CC said the activity hit Japanese organizations tied to cryptocurrency operations, while later analysis captured a full intrusion chain in which the initial script deployed staged implants including **Cabbage RAT** variants, a browser information stealer, **msoRAT**, and a credential theft component that abused Windows Security Packages. Across the reports, the malware showed consistent tradecraft: persistence through Startup-folder shortcuts and registry changes, victim filtering and antivirus checks, host reconnaissance via WMI, and command-and-control through **Bitly** links and spoofed cloud-themed domains such as **cloudfiles.club** and **msupdatepms.xyz**. The operators collected browser cookies, saved passwords, OS and hardware details, process lists, and likely system credentials, then used interactive follow-on access, including legitimate **VNC** tools, for manual post-compromise activity and possible cryptocurrency theft. Investigators also observed cleanup actions such as event log deletion and destructive behavior, and noted that the tooling and operational patterns shared multiple similarities with activity previously linked to **Lazarus**, though attribution remained unconfirmed.
Aug 15, 2026