Loading story…
Matanbuchus 3.0, a premium malware-as-a-service loader attributed to developer BelialDemon, is being used in social-engineering intrusions that begin with ClickFix prompts or Microsoft Teams vishing and Quick Assist abuse. In one investigated operation, a victim was induced to run a malicious MSI that deployed the loader through DLL sideloading; the infection chain ultimately installed the previously undocumented AstarionRAT. Operators then moved rapidly toward Windows servers and domain controllers using PsExec, created rogue accounts, and staged Microsoft Defender exclusions—activity consistent with preparation for ransomware deployment or data theft.
The C++ rewrite replaces older Matanbuchus mechanisms with encrypted Protobuf command-and-control over HTTP(S), ChaCha20-protected strings and shellcode, dynamic Windows API resolution, and extensive security-product discovery. Its two-module architecture uses anti-analysis delays, junk code, a Heaven’s Gate transition to evade WoW64 EDR hooks, and multiple DLL-sideloading stages; it can establish persistence through the Update Tracker Task scheduled task and execute payloads from disk or memory. Organizations should prioritize user resistance to ClickFix and remote-support impersonation, restrict and monitor Quick Assist and PsExec, investigate suspicious MSI and DLL-sideloading activity, and alert on Defender exclusion changes, anomalous scheduled tasks, and unauthorized domain-account creation.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
The operators returned the next day and, within roughly 40 minutes, used PsExec to move toward a Windows Server and two domain controllers. They created rogue accounts and staged files under a Microsoft Defender exclusion, but were disrupted before reaching their final objective.
Huntress responded to a hands-on intrusion that began when a ClickFix lure convinced a user to silently install a malicious MSI. The chain used Zillya AVCore.exe DLL sideloading to deploy Matanbuchus 3.0 and ultimately installed the previously undocumented AstarionRAT implant.
BelialDemon advertised the rewritten Matanbuchus 3.0 service, offering an HTTPS variant for about $10,000 monthly and a DNS variant for about $15,000 monthly.
Matanbuchus activity entered a brief operational hiatus around May 2025 before the developer resumed promotion of a new version.
A threat actor using the name BelialDemon advertised the C++ Matanbuchus malware loader on Russian-speaking/underground cybercrime forums as a malware-as-a-service offering.
In a separate observed delivery chain, an actor obtained access through Quick Assist, likely using social engineering, then downloaded and ran a malicious MSI containing HRUpdate.exe. HRUpdate.exe sideloaded a malicious DLL that acted as the Matanbuchus downloader, and researchers assessed the activity as likely intended to culminate in ransomware deployment.
The domain binclloudapp.com, later used as a remote MSI source in a ClickFix delivery chain, was newly registered.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 46 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourcezscaler.com
Open sourcehuntress.com
Open sourcemorphisec.com
Open sourcecyberark.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported renewed activity involving **Matanbuchus**, a **malware-as-a-service** loader sold on Russian-speaking cybercrime forums, where it has been advertised for rent at roughly **$2,500**. In observed campaigns, attackers used phishing emails carrying ZIP attachments that led victims through a multistage infection chain: an HTML file dropped another ZIP archive containing an MSI installer, which wrote a DLL and VBS file to disk and invoked `regsvr32.exe` to execute the malicious DLL. The loader then performed anti-analysis checks, created persistence through a scheduled task, and contacted command-and-control infrastructure to retrieve its next-stage payload directly in memory. Technical analyses showed that Matanbuchus uses obfuscated and encrypted strings, API hashing based on **FNV1a**, and HTTP communications to download follow-on malware while minimizing disk artifacts. Researchers linked the loader to deployments of **Cobalt Strike Beacons** and noted overlap with phishing operations involving other malware such as **Qakbot**. Reverse-engineering work also identified multiple infrastructure domains, sample hashes, and distinct loader and payload components, while updated **YARA** rules and configuration extractors improved detection of newer variants.
Aug 15, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026