Loading story…
ESET reported that the Varenyky Windows spambot targeted users in France, particularly customers of Orange S.A., after first appearing in 2019. The malware was delivered through phishing emails carrying malicious Word documents whose macros downloaded the payload, then checked system locale and keyboard layout to concentrate infections on French-language systems. Once installed, Varenyky communicated with its operators over Tor and sent spam through unsecured SMTP relay servers.
The malware supported multiple post-infection actions, including downloading and executing files, self-updating, uninstalling itself, stealing passwords with NirSoft tools, and running a hidden desktop. ESET also observed a short-lived capability to detect porn-related activity and record the victim’s screen with FFmpeg, indicating possible sextortion ambitions, while separately tracking botnet-driven sextortion emails demanding €750 in bitcoin. Researchers said they found no evidence that recorded videos were actually used in those scams and assessed the malware as being under active development, with features frequently added and removed.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
By June 2019, Varenyky was being distributed through phishing emails carrying malicious Microsoft Word documents. The lure claimed a bill for €491.27 was attached and used social engineering to get victims to enable macros.
ESET first saw the Varenyky malware in early May 2019 after observing telemetry related to malware targeting France. The malware primarily targeted French users, especially customers of Orange S.A.
Before releasing its research publicly, ESET notified Orange S.A. about the Varenyky activity targeting its customers.
One Varenyky feature scanned active window titles for French porn-related words or the word “bitcoin” and reported matches to the C2. A later version replaced title scanning with FFmpeg-based screen recording when the word “sexe” was encountered and uploaded the video to the C2.
Recent variants added a HIDDEN_DESK command that created a hidden desktop and enabled remote GUI interaction, including launching applications, reading text, taking screenshots, clicking, and manipulating windows.
Later Varenyky variants added a NIRSOFT command that deployed NirSoft WebBrowserPassView and Mail PassView to steal browser and email passwords and exfiltrate them to the command-and-control server.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French authorities warned that a large unsolicited email campaign used the subject line **"Nous avons reçu votre paiement."** to lure recipients into downloading a fake invoice, leading to ransomware infections across Windows environments. The messages linked to malicious downloads that ultimately delivered nested ZIP archives and executables, after which the malware encrypted files on infected workstations and accessible network shares before demanding payment for decryption. Analysis of the campaign tied the activity to **PyLocky**, a Python-based ransomware family that impersonated Locky in its ransom note but was technically unrelated to the original Locky malware. Researchers said the operation heavily targeted European victims, especially in France, and used signed executables, **PyInstaller**, and **Inno Setup** to hinder analysis; the malware encrypted numerous file types with **3DES**, gathered host details through **WMI**, delayed execution on low-memory systems as an anti-sandbox measure, and sent victim information to a command-and-control server over HTTP.
Aug 15, 2026
Researchers reported active phishing operations using business-document lures and fake "secure mail" messages to infect Windows users with **VIP Keylogger** and related infostealers. Splunk said attackers sent payment notices, procurement orders, and logistics updates carrying heavily obfuscated `.vbs`, `.js`, or `.bat` loaders that launched PowerShell stagers, hid data in environment variables, and used steganography in PNG files to rebuild the final payload. K7 Labs also tracked a malware-as-a-service **VIP_Keylogger** campaign, while Splunk said the malware injects into `aspnet_compiler.exe` and steals keystrokes, screenshots, browser and Outlook credentials, clipboard contents, and cryptocurrency wallet addresses before exfiltrating data to attacker infrastructure, including Telegram. AhnLab separately detailed a South Korea-focused campaign impersonating a major credit card company with malicious LNK files that executed PowerShell and `mshta`, fetched an HTA with obfuscated VBScript, and displayed decoy documents to reduce suspicion. The malware changed behavior depending on whether Windows Defender was enabled: one path delivered AES-encrypted archives with backdoor, keylogging, clipboard theft, and information-stealing components, while the other used `rundll32` to load a downloader that avoided VBox and VMware and then pulled additional payloads from Google Drive to steal browser, email, cookie, clipboard, and cryptocurrency wallet data. Defenders were urged to scrutinize email attachments and file types, monitor suspicious registry and PowerShell activity, and watch for script-launched processes and Telegram-related DNS traffic.
Jun 29, 2026
Securonix reported an ongoing phishing campaign dubbed **FAUX#ELEVATE** that targets French-speaking corporate environments with fake resume lures, including a VBScript file named `nouveau_curriculum_vitae.vbs`. The heavily obfuscated dropper shows a fake French error message, checks whether the victim is on a domain-joined enterprise machine, and pushes the user to grant administrator privileges before continuing. Once elevated, the malware disables security controls, downloads password-protected payloads from Dropbox, steals credentials from Firefox and Chromium-based browsers, collects desktop files, and exfiltrates data through `smtp.mail.ru:465` using victim country-code tagging. The intrusion chain also deploys a persistent remote access trojan and **XMRig**-based Monero mining components, with persistence established through Registry Run keys and a hidden scheduled task. Researchers said the RAT injects into `explorer.exe`, while command-and-control, mining configuration, and staging rely on compromised Moroccan WordPress sites, OVH-hosted infrastructure, a Swedish VPN provider, and legitimate tools such as 7-Zip and a signed kernel driver to blend in with normal traffic. Securonix assessed the operation as a financially motivated cybercrime campaign that rapidly completes its infection flow, cleans up artifacts, and monetizes enterprise access through both credential theft and cryptomining.
Jun 29, 2026