Loading story…
Researchers reported that the .NET-based August information stealer was used in targeted phishing campaigns against retail customer service and managerial staff, with attackers sending personalized purchase-support lures that delivered malicious Word documents. The documents used macros and PowerShell to filelessly load August from remote byte arrays, while evasion checks looked for analysis environments and tools such as Wireshark and Fiddler. Once installed, August could steal credentials, cookies, documents, wallet.dat files, cryptocurrency wallets, RDP files, and data from browsers, mail, messaging, and FTP applications before reporting host details back to command-and-control servers.
Separate analysis tied August to the emergence of CoalaBot, an HTTP-focused DDoS bot that appears to be built from or heavily derived from August code. CoalaBot was advertised with attack modes including HTTP GET, POST, Slowloris, and Pulse Wave, along with a so-called SMART mode intended to bypass protections such as Cloudflare and BlazingFast. Investigators said CoalaBot was distributed through BetaBot and Andromeda infections, including delivery via the RIG exploit kit in at least one HilltopAds malvertising chain, indicating that the same malware ecosystem was being used both for credential theft and for deploying DDoS capability.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Proofpoint observed multiple campaigns in November attributed to TA530 that targeted customer service and managerial staff at retailers with personalized purchase-support themed emails. The attacks used malicious Word macros and PowerShell to filelessly load the August information stealer.
Emerging Threats published rule 2024531 for 'ET TROJAN MSIL/CoalaBot CnC Activity.' The rule provided network detection coverage for CoalaBot command-and-control traffic.
The CoalaBot analysis concluded that the bot appears to be built from or heavily derived from August Stealer, citing very similar panel design and traffic characteristics. This connected the DDoS bot to the earlier August malware family.
A witnessed infection chain to CoalaBot was noted, showing the malware in active distribution. The post says CoalaBot was spread as tasks in BetaBot and Andromeda infections, with Andromeda delivering it via the RIG exploit kit and at least one malvertising chain linked to HilltopAds.
A translated advertisement for 'Coala Http Ddos Bot' was published by a user named Discomrade. The ad described a .NET 2.0 x86 HTTP-focused DDoS bot with multiple flood modes, SSL support for most attack types, optional .onion gates, encrypted traffic, and geofencing to avoid former CIS countries.
Proofpoint analyzed August as a new .NET-based, Confuser-obfuscated information stealer capable of collecting credentials, cookies, documents, RDP files, wallet.dat files, cryptocurrency wallets, and data from multiple applications. The report also documented its evasion checks, host profiling, and custom network obfuscation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported that **ACRStealer** is running an active credential-theft operation through multiple delivery chains, including a compromised `.edu` WordPress site and a trojanized **Chris-PC RAM Booster** installer. The malware uses a four-stage infection flow that progresses from PowerShell or installer-based execution to Go and .NET loaders, then decrypts and injects shellcode in memory. Researchers said newer samples introduced a previously undocumented .NET loader, **CoreHubManager**, a new 16-byte XOR key, **AES-256-CBC** shellcode decryption, and **Heaven’s Gate** WoW64 transitions to run x64 code from a 32-bit process. Payloads were also signed with a stolen **ASUSTeK EV code-signing certificate**, allowing binaries such as `sunwukongs.exe` to better evade SmartScreen and other trust controls. Once installed, ACRStealer steals credentials, browser data, DPAPI-protected secrets, Windows Hello NGC keys, smart card certificates, Azure AD OAuth tokens, wallets, documents, and tokens from more than 200 applications, then exfiltrates the data over HTTPS. The malware also uses custom AFD socket operations and dead-drop resolvers hosted on **Steam**, **Google Docs/Slides**, and **Telegram** pages to retrieve command-and-control infrastructure. Breakglass mapped **17 C2 IPs** in the newer cluster and **9 live C2 servers** in the earlier campaign, with the larger set hosted by **VDSINA**, pointing to a concentrated infrastructure footprint. Researchers also found overlap with **SectopRAT**, **AmateraStealer**, **NetSupport RAT**, **OffLoader**, **HIjackLoader/IDATLoader**, and **ClickFix/FakeCAPTCHA** chains, and said ACRStealer has been rebranded as **AmateraStealer** and marketed as a malware-as-a-service offering.
Jun 29, 2026
Researchers tied **ResolverRAT**, **LummaStealer**, and an **Amadey** botnet cluster to an active financially motivated campaign that has operated since at least late 2025 and uses fake browser update lures, staged loaders, and legitimate remote management tools for persistence. One analyzed chain used a Donut-decrypted, triple-protected `.NET` loader to deliver both ResolverRAT and LummaStealer at once, combining persistent remote access with credential and cryptocurrency wallet theft. The malware used layered obfuscation including .NET Reactor, custom transformations, AES-256-CBC, GZip, process hollowing, fragmented WinAPI reconstruction, forged compile timestamps, encrypted resource blobs, and certificate pinning, while operators rotated infrastructure across dozens of IPs, multiple domains, and hosting providers in Russia, the Netherlands, Germany, Poland, and elsewhere. Investigators also identified a fake Microsoft-themed domain, **pat[.]microsoft-telemetry[.]at**, and newly activated infrastructure such as **kampf[.]huehnchenfarm[.]ru** tied to the same ecosystem. A parallel March 2026 investigation linked the **fbf543** Amadey campaign to more than 50 payloads spanning at least 13 malware families, including Vidar, QuasarRAT, XWorm, AsyncRAT, Smoke Loader, and LummaStealer, with delivery through fake installers and hosting on infrastructure centered on **Omegatech LTD (AS202412)** and related abusive networks. Analysts found that the operators also abused nine legitimate, signed RMM tools from **ConnectWise, DattoRMM, Atera, GoToResolve, and N-able**, configuring them to beacon to attacker-controlled relays rather than compromising the vendors themselves. A separate Go-based loader unpacked LummaStealer with AES, RC4, and QuickLZ before hollowing **AppLaunch.exe**, reinforcing a playbook built around stealthy loaders, infostealer deployment, redundant access channels, and monetization consistent with an initial access broker or ransomware affiliate operation.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026