Loading story…
Malware operators are increasingly using TLS/HTTPS to conceal command-and-control, payload delivery, and data exfiltration traffic, with one report finding TLS-backed malware rising from 23% of Internet-communicating malware in 2020 to nearly 46% in early 2021. Researchers said attackers are blending into normal encrypted traffic by abusing trusted platforms and services including Google, Discord, Pastebin, GitHub, and Telegram, while loaders, droppers, ransomware affiliates, and offensive tools such as Cobalt Strike and Metasploit increasingly rely on encrypted channels. Malware also frequently uses TLS on non-standard ports, reducing the value of simple port-based detection.
A separate analysis of 264 malware families found most SSL/TLS-protected malware communications used HTTPS, while others used SMTP and custom TCP protocols, and that many families relied on self-signed certificates or reused anomalous X.509 attributes that can expose malicious infrastructure. Researchers identified unusual subject names, abnormal serial-number lengths, invalid version fields, and suspicious validity periods as useful detection signals, while noting that some families such as IcedID, AsyncRAT, DcRAT, Vawtrak, and PhantomNet use certificate pinning to resist interception. The findings also show that attackers often deploy valid certificates from trusted authorities, especially Let’s Encrypt, underscoring that certificate metadata and anomaly-based inspection remain important for detecting encrypted malware traffic.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that 696 of 1,067 self-signed malware certificates had already expired as of August 6, 2021. The same analysis found that about 60.4 percent of the malware certificates in its searchable dataset were self-signed.
As of June 29, 2021, Trend Micro found 1,767 of 4,093 malware-related certificates available from queried certificate search engines such as Censys and crt.sh. The dataset supported its analysis of self-signed and CA-issued malware certificates.
Trend Micro's study period ended in June 2021 after examining 264 malware families using SSL/TLS in command-and-control and related communications. The report found HTTPS was the dominant protected protocol, with additional use of SMTP and custom TCP.
Sophos reported that in February 2021, droppers accounted for over 90 percent of observed TLS command-and-control traffic. The report said most TLS-backed malicious activity involved malware retrieving additional payloads.
By early 2021, Sophos telemetry showed nearly 46 percent of malware detected communicating over the Internet used TLS. The increase was linked in part to abuse of legitimate services such as Discord, Pastebin, GitHub, Telegram, and Google cloud services.
Sophos telemetry found that 23 percent of malware detected communicating over the Internet used TLS in 2020. The report framed this as a baseline before a sharp rise in early 2021.
Trend Micro's certificate analysis covered 264 unique malware families observed between May 2019 and June 2021. This marks the start of the study period used for its findings on SSL/TLS use in malware C2.
The Trend Micro brief states that Gozi used the subject "C=XX, ST=1, L=1, O=1, OU=1, CN=*" across hundreds of variants from 2018 through 2021. The certificates typically used 8-byte serial numbers and a 10-year validity period.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that malware operators are increasingly abusing **Discord’s CDN, APIs, and webhooks** to host payloads, manage command-and-control, and exfiltrate stolen data. The researchers identified more than **9,500 unique malicious Discord CDN URLs** in April and **17,000 unique malware URLs** during the second quarter, with more than **4,700** still active shortly before publication. Prior telemetry cited in the report found Discord accounted for **4% of TLS-protected malware downloads**, while **20% of malware TLS traffic** involved legitimate online services, underscoring how attackers are blending into trusted platforms. The malicious content included credential stealers, RATs, ransomware, Android malware, droppers, spyware, backdoors, and game-themed lures such as fake cheats and cracked software. Sophos said the most common campaigns targeted **Discord OAuth tokens** and other credentials to hijack accounts and spread additional scams, while some samples disabled security tools or fetched secondary payloads. The report also identified **58 unique malicious Android apps** and **205 Discord-hosted APK URLs**, including banking Trojans, and concluded that Discord remains an attractive abuse channel because its infrastructure is free, globally available, and widely trusted, despite the company removing many reported files after takedown requests.
Jun 29, 2026
Multiple sophisticated malware campaigns have been identified targeting organizations and individuals across various regions, utilizing advanced loader techniques and evasion tactics. Notable threats include AuraStealer, a malware-as-a-service infostealer distributed via social media scams and cracked software, capable of stealing data from a wide range of browsers and applications, and employing anti-analysis features such as geolocation checks and virtual machine detection. CloudEyE, another malware-as-a-service downloader and cryptor, has seen a dramatic increase in detections, serving as a delivery mechanism for other malware like Rescoms, Formbook, and Agent Tesla, and leveraging multi-stage delivery tactics to avoid detection. Additionally, a commodity loader has been used in targeted email campaigns against manufacturing and government sectors, employing weaponized documents, steganography, and multi-layered evasion pipelines to distribute remote access trojans and infostealers. The Tuoni C2 malware framework was used in a stealthy attack against a major U.S. real estate firm, utilizing AI-generated code, steganography, and memory-only execution to evade detection and maintain long-term access for credential theft and potential ransomware deployment. These campaigns highlight a trend toward modular, evasive malware delivery systems that leverage commodity loaders, steganography, and malware-as-a-service models, enabling threat actors to efficiently compromise targets while minimizing forensic footprints. Security researchers emphasize the need for advanced detection and prevention strategies to counter these evolving threats, as traditional security layers are increasingly bypassed by modern malware techniques.
Jun 29, 2026
Multiple reports highlight continued growth in **commercially sold malware**—particularly infostealers and remote-access tooling—lowering the barrier for credential theft and enterprise targeting. Fortinet-described activity shows a **phishing-led Agent Tesla** delivery chain using business-themed lures (e.g., purchase orders), compressed attachments, and obfuscated scripting (e.g., `.jse`) to execute largely **in-memory**, leveraging techniques such as **process hollowing** and anti-analysis to reduce on-disk artifacts and evade endpoint controls while stealing browser, email, and other credentials. Separately, researchers described new or increasingly marketed “as-a-service” tools that expand attacker capability across both Windows and Android. Flashpoint detailed **DarkCloud**, a low-cost infostealer sold via Telegram/clearnet that targets a wide range of browsers and enterprise-adjacent applications (email clients, FTP tools, VPNs), and uses legacy components (e.g., `MSVBVM60.DLL`) to complicate modern detection. Certo reported **Oblivion**, an Android RAT sold via subscription that targets Android 8–16 and emphasizes automated permission bypass and **hidden remote control (HVNC/VNC-like)** functionality alongside SMS/2FA interception and device takeover features. BlackFog reported **Steaelite**, a Windows RAT marketed to enable **double extortion** by combining data theft and ransomware deployment workflows in a single web panel, with HVNC monitoring and an announced Android ransomware module in development. A separate 2025 retrospective from TG Soft’s C.R.A.M. reinforces that **malspam-delivered password stealers** remain prevalent, with **Agent Tesla**, FormBook, and Remcos among the most common families observed in email campaigns.
Jun 29, 2026