Loading story…
A malicious MSI installer impersonating Palo Alto Networks GlobalProtect has targeted users in Myanmar, using trusted Cloudflare infrastructure and Google Sheets to support command-and-control (C2) activity. The campaign abuses the legitimacy and availability of these cloud services to blend malicious communications with ordinary web traffic and complicate network-based detection.
The installer’s operation is associated with Windows DLL-loading behavior, a common avenue for malware to execute malicious libraries through trusted applications or search-order weaknesses. Organizations with Myanmar-facing personnel should validate GlobalProtect installers against official sources and signatures, monitor endpoint installation activity, and investigate unexpected Cloudflare- or Google Sheets-related connections originating from VPN-client or installer processes.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 references tracked. Mallory keeps watching after this page renders.
malwareinfo.app
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used spear-phishing emails with `TinyURL` links and an actor-controlled redirection server to deliver the **9002 Trojan** from a Google Drive-hosted ZIP archive. The redirection chain embedded a target email address and destination URL in base64-encoded parameters, apparently to track victim clicks, and one lure targeted a legitimate Myanmar politician and human rights activist. The downloaded executable posed as a PowerPoint file, displayed a Myanmar-related conference decoy, and installed malware through **DLL sideloading** by abusing a legitimate RealNetworks executable. Researchers linked the campaign’s infrastructure and beaconing artifacts to broader activity associated with **Poison Ivy**, **PlugX**, **Zupdax**, **HenBox**, and the later-identified **Farseer** malware family. Farseer shared tradecraft including DLL sideloading with signed binaries, encrypted and compressed payloads, obfuscated configuration data, registry persistence, and command-and-control over domains such as `update.tcpdo[.]net`, `honor2020[.]ga`, and `up.outhmail[.]com`. The overlapping infrastructure and Myanmar- and Southeast Asia-themed lures indicate a sustained intrusion set focused on targets in Myanmar, Taiwan, and the wider region.
Aug 15, 2026
Researchers uncovered two large-scale malicious infrastructures that used Cloudflare-fronted domains and wildcard subdomains to hide centralized backend systems. In one campaign, investigators traced an **adversary-in-the-middle (AiTM)** phishing operation from four suspicious domains to at least seven domains and more than **200 subdomains** impersonating enterprise **VPN** and **SSO** portals, including Palo Alto GlobalProtect, Fortinet FortiGate, Cisco AnyConnect, Citrix, and Microsoft OWA. The phishing flow presented fake Cloudflare challenge pages before credential prompts, and the infrastructure was linked to a single origin server at `178.16.53.131` in Germany. Researchers said the platform could relay live authentication sessions and steal both credentials and session tokens, allowing attackers to bypass traditional MFA protections. A separate investigation tied a single ClearFake indicator to a broader malware delivery network spanning **24 `.in.net` domains**, more than **100 subdomains**, two Cloudflare account clusters, and a shared **WebDAV** origin server. Analysts found wildcard DNS and TLS certificates across the domains, identical `ETag` values indicating common hosting, and an exposed payload inventory accessible through unauthenticated WebDAV requests. The campaign used compromised websites to redirect victims to fake verification pages and then delivered malicious DLLs and two newly identified obfuscated Go binaries disguised as Logitech and Intel components. Breakglass reported that the recovered payloads had **zero detections** in VirusTotal and MalwareBazaar at the time of discovery, while multiple OPSEC mistakes—including leaked headers, an exposed staging directory, and a recurring "werification" typo—helped map the operation.
Jun 29, 2026
Researchers reported a recruitment-themed malware campaign targeting Indian government job seekers with a fake Cabinet Secretariat notice for Senior Field Officer roles. The infection chain delivers a ZIP archive containing a malicious `.lnk` file, a PowerShell script, and a `.NET` executable that installs the legitimate ControlR remote management agent alongside a custom RAT called **SheetAgent**. The malware persists through a scheduled task or Startup-folder shortcut, disguises files with Windows-like names, and uses anti-VM, anti-sandbox, and self-cleanup checks to hinder analysis. Seqrite said SheetAgent uses hardcoded Google service account credentials to access **Google Sheets** and **Google Drive**, with an attacker-controlled sheet acting as a backup command-and-control and exfiltration channel. Investigators also linked infrastructure at `38.242.157.89` to the decoy PDF and several authenticated management panels, including **SecureMonitor** and **PrivateRat**. The tradecraft overlaps with earlier campaigns that used cloud services such as Google Sheets, Firebase, GitHub, and Microsoft Graph for covert C2 against Indian targets, and Seqrite attributed the operation to **APT36** with medium confidence.
Jul 14, 2026