Loading story…
A malvertising campaign traced to at least October 2016 targeted millions of visitors to popular news websites with advertisements that concealed malicious JavaScript in image transparency values. ESET subsequently identified the activity as a new wave of AdGholas, which had switched from Angler and Neutrino to the Stegano exploit kit, also known as Astrum. The infection chain used an Internet Explorer vulnerability to check the victim’s environment and three Flash vulnerabilities to compromise susceptible systems without requiring user interaction.
The campaign employed multiple anti-analysis checks, encrypted communications, and payloads disguised as GIF images to evade detection. Observed payloads contained or downloaded Ursnif and Ramnit, exposing victims to credential theft, surveillance, banking fraud, and further compromise. The attack demonstrated that visiting a legitimate website could trigger infection through third-party advertising; eliminating legacy Internet Explorer and Flash exposure and restricting untrusted advertising content are key defensive measures against this attack pattern.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
The analyzed campaign was traced to at least the beginning of October 2016 and targeted millions of readers of popular news websites, focusing on Canada, Britain, Australia, Spain, and Italy. Malicious advertisements concealed JavaScript in image transparency values and initiated the infection chain without requiring a click.
Stegano activity targeted users in the Czech Republic in spring 2015.
Earlier Stegano exploit-kit activity targeted Dutch users in late 2014.
A December 15 update attributed the analyzed malvertising campaign to a new wave of AdGholas after comparison with Proofpoint and Trend Micro findings. The update identified a switch from Angler and Neutrino to Stegano, also known as Astrum.
Researchers detailed Stegano's image-based code concealment, anti-analysis checks, use of an Internet Explorer vulnerability and three Flash vulnerabilities, and encrypted payload delivery. They published compromise indicators and identified observed payloads as containing or downloading Ursnif and Ramnit.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 83 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple exploit kits remained active despite the broader decline of the exploit-kit ecosystem, using **malvertising**, compromised sites, and traffic distribution systems to drive victims to landing pages that exploited legacy **Internet Explorer** and **Adobe Flash Player** vulnerabilities. Reports identified **RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude, Angler,** and **GreenFlash Sundown** abusing flaws including `CVE-2021-26411`, `CVE-2020-1380`, `CVE-2018-8174`, `CVE-2018-15982`, `CVE-2018-4878`, `CVE-2016-0189`, and `CVE-2015-0311`. Researchers said continued Internet Explorer use, unsupported Flash installations, and region-specific targeting kept drive-by download attacks viable, particularly across Japan, South Korea, Taiwan, Hong Kong, Malaysia, and other parts of Asia. The campaigns delivered a wide range of malware families, showing that exploit kits were still an effective access vector for both cybercrime and broader malware operations. **Spelevo** was tied to the Japanese **PseudoGate** campaign distributing **Ursnif**, **SmokeLoader**, **Ramnit**, **Kronos**, and **Zloader**; **RIG** was seen pushing **Pitou.B** and ransomware such as **CryptoLuck** and **Revenge**; **Magnitude** delivered **Magniber** ransomware; **Underminer** deployed a **bootkit** and **coinminer**; **GreenFlash Sundown** delivered **Hermes** ransomware; **Angler** installed the **Bedep** trojan; and **PurpleFox** was linked to **DirtyMoe** cryptojacking and DDoS malware. The reporting underscored that unpatched or unsupported browsers and plugins continued to expose organizations to silent compromise, ransomware, banking trojans, spam bots, and cryptomining infections.
Aug 15, 2026
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026
The **EITest** web-injection campaign used compromised websites to redirect victims into multiple malware chains, including a **Rig exploit kit** path that delivered **Spora ransomware**. In one documented infection flow, an injected script on `naturalhealthonline[.]com` redirected users to infrastructure at `92.53.127[.]86`, where **Rig-V** served a Flash exploit and dropped a Spora payload. Reporting on the broader exploit-kit ecosystem also noted **RIG** evolving as other kits faded, underscoring its continued role in web-based malware delivery. Later reporting showed EITest operators changing tactics: fake **HoeflerText** browser popups aimed at **Google Chrome** users began pushing malware that installed the legitimate remote administration tool **NetSupport Manager** as a **RAT** instead of primarily delivering ransomware such as **Spora** or **Mole**. The lure used a bogus font update executable, `Font_Chrome.exe`, to download additional malware from attacker-controlled infrastructure, while **Internet Explorer** users were redirected to fake antivirus and tech-support scam pages, indicating browser-specific monetization and a broader move toward post-compromise access rather than immediate encryption.
Aug 15, 2026