Loading story…
A campaign potentially linked to the SilverFox/UTG-Q-1000 ecosystem used SEO poisoning to steer users to fraudulent KakaoTalk download sites hosting trojanized installers. The operators repeatedly altered installer presentation and packaging, moving among NSIS, Advanced Installer, and Inno Setup while bundling legitimate installation components with malicious files to evade detection.
Earlier samples patched legitimately signed executables, while later variants used DLL side-loading: Java Control Panel (javacpl.exe) loaded a malicious deploy.dll that retrieved ValleyRAT. More recent installers concealed encrypted shellcode in PNG files, created randomized artifacts under C:\msys64, registered persistence as a service, and deployed Ghost malware. Command-and-control infrastructure overlapped with systems previously tied to Ghost and MODBEACON, supporting a possible SilverFox connection, although attribution remains unconfirmed.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
The latest observed variants concealed encrypted shellcode in PNG files, created randomly named artifacts under C:\msys64, and established execution through a Windows service. Their final payload was identified as Ghost.
Later variants shifted to DLL side-loading, including a chain in which Java Control Panel (javacpl.exe) loaded a malicious deploy.dll. The DLL contacted command-and-control infrastructure and downloaded ValleyRAT.
Earlier observed samples modified legitimate files bearing valid digital certificates so they would execute malicious shellcode when the disguised installer ran.
A threat actor redirected users searching for KakaoTalk to fraudulent download sites that served installers impersonating KakaoTalk. The installers included legitimate installation components alongside malicious files and were packaged over time with NSIS, Advanced Installer, and Inno Setup.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
Multiple active malware campaigns are using **trojanized installers** and social engineering—rather than software vulnerabilities—to gain initial access and then deploy credential theft or remote-control capabilities. Intel 471 reported a new Android banking trojan dubbed **FvncBot** targeting Polish mobile banking users by impersonating an *mBank* “security” app; the dropper prompts installation of an additional “Play” component and then abuses **Android Accessibility Services** for persistence and control, enabling **keylogging**, **screen capture**, and hidden **VNC-style remote interaction** to facilitate fraudulent transactions. Separately, Cyderes described an ongoing, large-scale piracy-channel campaign where cracked game installers hide behind a legitimate-looking **Ren’Py** launcher tracked as **RenEngine**, which decrypts and launches subsequent stages and introduces **HijackLoader** via techniques including **DLL side-loading** and module stomping; observed final payloads include **ACR Stealer** (and in some cases **Vidar**) to exfiltrate browser credentials, cookies, and crypto wallet data. Cybereason detailed a different installer-themed operation in Chinese-speaking communities delivering **ValleyRat/Winos 4.0** attributed to **Silver Fox APT**, notable for using the rare **“PoolParty Variant 7”** process injection (abusing Windows I/O completion ports and `ZwSetIoCompletion()` after duplicating a handle from `Explorer.exe`) plus a strengthened watchdog mechanism via injection into `Explorer.exe` and `UserAccountBroker.exe` to maintain persistence.
Jun 29, 2026
Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including **Google Chrome**, **Microsoft Teams**, **Surfshark**, **Signal**, **Telegram**, **Zoom**, **DeepSeek**, **Quark Cloud**, and activation tools. The attacks rely on spoofed download sites and malicious `MSI` or `NSIS` packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the **Gh0st RAT** ecosystem, including modified Gh0st variants and **Atlas RAT**. Researchers linked the activity to Chinese-speaking threat actors including **Dragon Breath** and **Silver Fox**, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates. The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned `WDAC` policies to block Chinese antivirus tools, **Protected Process Light** abuse to corrupt **Microsoft Defender**'s `MsMpEng.exe`, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.
Aug 14, 2026