Loading story…
MintsLoader, a multi-stage JavaScript-to-PowerShell loader associated primarily with TAG-124/LandUpdate808 and linked downstream activity to UNC4108/TA582, is targeting energy, industrial, legal, oil-and-gas, and other organizations in the United States and Europe. The campaigns use phishing, compromised websites, fake browser updates, and ClickFix/KongTuke fake CAPTCHA lures—including abuse of Italy's PEC certified-email system—to induce execution. The loader bypasses AMSI, scores hosts for sandbox or VM indicators, and uses rotating date-seeded DGA domains to retrieve payloads while sending AsyncRAT decoys to likely analysis environments.
On selected victim systems, MintsLoader commonly deploys the fileless GhostWeaver PowerShell RAT, which uses TLS 1.0 over TCP/25658 and Gzip-compressed JSON for C2; StealC and modified BOINC clients have also been delivered. A newer variant retrieves an in-memory PowerShell stager through the legacy Finger protocol and uses Hashtable-based decoding plus a reflected, compressed .NET assembly to conceal later stages. Researchers identified active GhostWeaver C2 nodes at 178.156.128.182 and 86.107.101.93 that served a persistence installer with scheduled-task persistence, AV-aware behavior, and a CMSTPLUA UAC-bypass mechanism; defenders should prioritize detection of finger.exe spawning command interpreters, suspicious headless PowerShell tasks, AMSI-bypass activity, DGA-driven HTTP traffic, and GhostWeaver TLS on port 25658.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Live probing identified active GhostWeaver C2 nodes at 178.156.128.182 and 86.107.101.93. Both accepted beacons without validation and rapidly delivered the same 206KB persistence installer.
TRAC Labs assigned the name GhostWeaver to the fileless PowerShell RAT used as a principal MintsLoader payload.
Analysts observed a phishing campaign targeting energy, oil and gas, and legal organizations in the United States and Europe with malicious JavaScript attachments and fake “Click to verify” pages that delivered MintsLoader.
Orange Cyberdefense detected widespread MintsLoader distribution between July and October 2024 through phishing and drive-by download activity.
SocGholish/FakeUpdates activity began using MintsLoader around July 2024, including infections that installed modified BOINC clients connected to attacker-controlled infrastructure.
Insikt Group identified MintsLoader activity in a February SocGholish infection, based on Palo Alto Networks Unit 42 analysis.
Orange Cyberdefense first observed the PowerShell-based, multi-stage MintsLoader malware loader, also tracked as TAG-124, LandUpdate808, and UNC4108.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 67 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourcederp.ca
Open sourceblackpointcyber.com
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**MintsLoader**, a multi-stage PowerShell malware loader also tracked as **TAG-124**, **LandUpdate808**, and **UNC4108**, has expanded operations across the US and Europe by targeting industrial, legal, energy, electricity, and oil-and-gas organizations. Reporting ties the activity to phishing emails, **ClickFix**-style lures, fake browser or software update pages on compromised websites, and **SocGholish** drive-by compromises. Researchers said the infection chain commonly starts with JavaScript or JScript files that launch heavily obfuscated PowerShell, perform **AMSI bypass** and anti-VM or sandbox checks, fingerprint victims, and use domain generation algorithms to rotate command-and-control infrastructure while serving decoys to analysis environments. The campaigns have delivered multiple second-stage payloads, including **StealC**, **GhostWeaver**, and modified **BOINC** clients, with one observed chain downloading a packed StealC sample from `temp[.]sh` and another fake-update variant fetching staged content from attacker-controlled `.top` domains. Analysts described LandUpdate808 as a distinct fake-update cluster that evolved its staging URLs and visitor-tracking logic, while later reporting linked it directly to the broader MintsLoader ecosystem and to sustained operations by TAG-124, with SocGholish adopting the loader as an alternative delivery path. As of early 2026, researchers reported concurrent C2 clusters and more than 200 DGA domains, indicating a durable and growing malware delivery operation.
Aug 15, 2026
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
An active malware campaign is using **ClickFix** fake CAPTCHA pages to trick users into pasting and running malicious PowerShell commands. The infection chain deploys GHOSTPULSE—also known as **HijackLoader** or IDATLOADER—using DLL sideloading, followed by a .NET intermediary that decrypts and reflectively loads the ARECHCLIENT2/SectopRAT remote-access trojan directly into memory. The deceptive CAPTCHA pages were hosted on client subdomains of `dealeronlinemarketing.com` and `contology.com`, which researchers assess were likely enabled by the compromise of server `50.57.243[.]90`. ARECHCLIENT2 bypasses AMSI, profiles infected systems, steals credentials, browser data, and cryptocurrency-wallet information, and receives commands from rotating command-and-control infrastructure. SectopRAT is a .NET-based RAT with a history of anti-analysis protections, including ConfuserEx control-flow obfuscation and anti-tamper measures; its deployment through reflective loading further reduces disk-based detection opportunities. Organizations should prioritize user awareness of fake CAPTCHA copy-and-paste prompts and detect anomalous PowerShell execution, DLL sideloading, and in-memory .NET loading behavior.
Sep 9, 2026