Loading story…
The EITest web-injection campaign used compromised websites to redirect victims into multiple malware chains, including a Rig exploit kit path that delivered Spora ransomware. In one documented infection flow, an injected script on naturalhealthonline[.]com redirected users to infrastructure at 92.53.127[.]86, where Rig-V served a Flash exploit and dropped a Spora payload. Reporting on the broader exploit-kit ecosystem also noted RIG evolving as other kits faded, underscoring its continued role in web-based malware delivery.
Later reporting showed EITest operators changing tactics: fake HoeflerText browser popups aimed at Google Chrome users began pushing malware that installed the legitimate remote administration tool NetSupport Manager as a RAT instead of primarily delivering ransomware such as Spora or Mole. The lure used a bogus font update executable, Font_Chrome.exe, to download additional malware from attacker-controlled infrastructure, while Internet Explorer users were redirected to fake antivirus and tech-support scam pages, indicating browser-specific monetization and a broader move toward post-compromise access rather than immediate encryption.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
In late August 2017, the EITest HoeflerText popup activity reappeared and shifted from primarily delivering ransomware to delivering file downloaders. Recent Font_Chrome.exe samples then installed the NetSupport Manager remote access tool on infected Windows hosts.
The HoeflerText popup activity paused in late July 2017. This interruption preceded the campaign's reappearance with a different malware objective.
By July 2017, EITest HoeflerText popups were delivering Mole ransomware under the filename Font_Chrome.exe. This continued the campaign's ransomware distribution through fake font-update lures.
On January 17, 2017, an injected EITest script on naturalhealthonline[.]com redirected victims to Rig-V infrastructure at 92.53.127[.]86, which used a Flash exploit to deliver a Spora ransomware payload. The analysis noted no callback traffic from Spora after infection, aside from HTTPS traffic to spora[.]bz when decryption instructions were manually followed.
Spora ransomware was first reported before its later delivery through the EITest campaign. The source explicitly dates its first reporting to January 10, 2017.
Since late January 2017, EITest HoeflerText popup activity had been observed delivering only ransomware. This established the campaign's ransomware-focused phase before later changes in 2017.
The EITest campaign began using fake HoeflerText popups to socially engineer Google Chrome users into downloading malware. This tactic was observed as early as December 2016.
Researchers described Rig-V as what they called Rig EK version 4, a variant previously accessible only to VIP customers. This marked an evolution in the RIG exploit kit ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
malware-traffic-analysis.net
Open sourceresearchcenter.paloaltonetworks.com
Open sourcemalware.dontneedcoffee.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026
Multiple exploit kits remained active despite the broader decline of the exploit-kit ecosystem, using **malvertising**, compromised sites, and traffic distribution systems to drive victims to landing pages that exploited legacy **Internet Explorer** and **Adobe Flash Player** vulnerabilities. Reports identified **RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude, Angler,** and **GreenFlash Sundown** abusing flaws including `CVE-2021-26411`, `CVE-2020-1380`, `CVE-2018-8174`, `CVE-2018-15982`, `CVE-2018-4878`, `CVE-2016-0189`, and `CVE-2015-0311`. Researchers said continued Internet Explorer use, unsupported Flash installations, and region-specific targeting kept drive-by download attacks viable, particularly across Japan, South Korea, Taiwan, Hong Kong, Malaysia, and other parts of Asia. The campaigns delivered a wide range of malware families, showing that exploit kits were still an effective access vector for both cybercrime and broader malware operations. **Spelevo** was tied to the Japanese **PseudoGate** campaign distributing **Ursnif**, **SmokeLoader**, **Ramnit**, **Kronos**, and **Zloader**; **RIG** was seen pushing **Pitou.B** and ransomware such as **CryptoLuck** and **Revenge**; **Magnitude** delivered **Magniber** ransomware; **Underminer** deployed a **bootkit** and **coinminer**; **GreenFlash Sundown** delivered **Hermes** ransomware; **Angler** installed the **Bedep** trojan; and **PurpleFox** was linked to **DirtyMoe** cryptojacking and DDoS malware. The reporting underscored that unpatched or unsupported browsers and plugins continued to expose organizations to silent compromise, ransomware, banking trojans, spam bots, and cryptomining infections.
Aug 15, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026