Loading story…
Attackers temporarily modified AOMEI update configuration files to redirect software downloads to malicious infrastructure, according to Mandiant research linking the activity to UNC7017. One infection chain used the CROSSROAD downloader to deploy legitimate Radmin components alongside the SHINYROAD backdoor; another delivered ADAPTAGENT disguised as Nitro PDF software. The activity combined geographic execution restrictions, DLL hijacking, scheduled-task persistence, encrypted in-memory Python execution, and encrypted command-and-control traffic interspersed with randomized junk packets.
A separate configuration modification attempted to coerce NTLM authentication through an invisible WebDAV popup, adding a credential-exposure risk beyond malware delivery. The short-lived tampering underscores the need to preserve update configurations and download telemetry for retrospective investigation. Defenders should validate software-update destinations, investigate unexpected DLL loading and scheduled tasks, and monitor unusual outbound WebDAV authentication. Mandiant supplied infrastructure indicators and four YARA rules to support detection and threat hunting.
Trace attribution and downstream blast radius.
11 events from the most recent confirmed update back to the earliest known activity.
On July 29, AOMEI told Mandiant it had taken corrective action to secure its servers, following Mandiant's July 17 notification and provision of indicators. ManageEngine had not independently confirmed containment as of publication, and server-side remediation did not remove existing endpoint infections.
On May 28, ManageEngine discovered the malicious activity after AOMEI Backupper installed a modified Radmin remote administration tool on two unrelated endpoints in different countries during the same timeframe.
Researchers reported that attackers also targeted AOMEI AnyViewer because it relies on the same update mechanism as Backupper. The reference does not specify confirmed AnyViewer infections.
AOMEI released a free detection tool and urged users who ran Backupper during the exposure windows to update and scan their systems. The company acknowledged it had not yet identified or notified infected customers and said it would assess potentially affected users and contact them.
Google Cloud identified compromised organizations in higher education, IT services, and telecommunications across 11 countries, including Australia, India, and the United States. Researchers assessed the distribution as opportunistic, affecting systems that fetched malicious content during brief configuration-tampering windows.
Mandiant disclosed the configuration-tampering technique, payload execution chains, and infrastructure indicators, alongside four YARA rules covering CROSSROAD, SHINYROAD, and ADAPTAGENT. The supplied rules associate the AOMEI update targeting and ADAPTAGENT payloads with UNC7017.
A malicious Notifycfg.ini entry configured a 1-by-1-pixel popup to load a file URL pointing to 8.210.84.56. The modification attempted to trigger WebDAV-based NTLM authentication to the attacker-controlled endpoint.
Another payload chain used NitroPromotion.exe and Nitro_Scan2PDFApp.exe to side-load ADAPTAGENT through Eztwain4.dll. It stored artifacts under the user's Nitro Pro directory, used the NitroRuntime scheduled task, and beaconed to 8.210.84.56 on TCP port 6800.
Disguised as an AOMEI update component, CROSSROAD retrieved secondary archives and deployed legitimate Radmin components alongside SHINYROAD, using DLL search-order hijacking and a scheduled task for execution and persistence. The downloader checked its execution directory and external-IP geography, aborting its primary payload path for country code CN.
Attackers ephemerally modified AOMEI's remote down_html.ini configuration to redirect upgrade-now.zip downloads to attacker-controlled infrastructure. Observed configurations pointed to promotion.storage-data.com or the aomeiupdate Cloud Storage bucket and changed version and MD5 fields.
The attackers registered storage-data.com and staged upgrade-now.zip, component.zip, and en.zip before the configuration-tampering windows. Payload infrastructure included storage-data.com subdomains, Alibaba Cloud OSS, and the public Google Cloud Storage bucket aomeiupdate.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 40 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
15 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcetherecord.media
Open sourcesecurityweek.com
Open sourcecryptika.com
Open sourcecloud.google.com
Open sourcethehackernews.com
Open sourcecloud.google.com
Open sourcemanageengine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued abuse of **fake browser and software update pages** on compromised websites to trick Windows users into installing malware, with multiple investigations tying the lure to delivery of **NetSupport Manager RAT** and broader **SocGholish/FakeUpdates** activity. Trellix described a campaign in which injected JavaScript redirected visitors to counterfeit Chrome update pages, then launched a staged infection chain using JavaScript, batch files, VBScript, `curl`, and a portable **7-Zip** utility to install NetSupport while avoiding PowerShell. Mandiant documented a similar chain in which a disguised archive and scripts unpacked NetSupport from `%AppData%`, established persistence through startup shortcuts and registry artifacts, and enabled remote desktop control, file transfer, system inventory, application launch, and geolocation.
Aug 15, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026