Loading story…
Recent campaigns have demonstrated that cybercriminals are increasingly blending credential phishing and malware delivery in a single attack. This dual-threat approach allows attackers to bypass defenses focused on only one threat vector. Notable malware used includes ConnectWise RAT, Muck Stealer, Info Stealer, and SimpleHelp RAT.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cofense Intelligence reported that phishing operations are increasingly fingerprinting victims' operating systems, browsers, and environments to tailor payloads, sending malware to some users and credential phishing pages to others from the same lure infrastructure. The report also highlighted abuse of legitimate remote access tools such as ConnectWise RAT, Itarian RAT, and Ninite Loader as a detection blind spot.
Initial story creation
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented several **multi-stage malware campaigns** delivering remote-access trojans including **NetSupport RAT**, **Agent Tesla**, **Remcos RAT**, and **CastleRAT/NightShadeC2** through obfuscated scripts, phishing lures, and malicious installers. One NetSupport intrusion used Microsoft SafeLinks redirection, intermediary URLs, obfuscated JavaScript, and hidden PowerShell to fetch ZIP payloads via BITS, then launched `client32.exe` from an `%AppData%\aragdrts` folder and established persistence through scheduled tasks, Startup entries, and Registry Run keys. Separate analyses of Agent Tesla and Remcos samples showed BAT, CMD, JavaScript, and PowerShell stages that decoded or decrypted .NET payloads, with Agent Tesla configured for credential theft, keylogging, screen capture, and SMTP-based exfiltration, while Remcos included functions to disable Microsoft Defender and persist by copying its launcher into the Windows Startup path. A later intrusion report showed how these commodity malware chains are being used for **immediate fraud operations** rather than only initial access. In that case, a malicious `CarrierRegistration.msi` delivered **Matanbuchus**, then **NetSupport RAT**, **Remcos RAT**, and finally **CastleRAT**, which was used to harvest browser credentials and proxy the victim’s live browser session into financial-site login attempts from the compromised host. The activity indicates a shift from simple information theft toward **hands-on-keyboard account takeover**, where attackers exploit stolen sessions and local browser context directly to evade fraud controls tied to device, IP, and session reputation.
Jul 7, 2026
Cybersecurity researchers have identified a surge in malware campaigns leveraging the ClickFix social engineering technique to deploy the Amatera Stealer and NetSupport RAT. These campaigns trick users into executing malicious commands through the Windows Run dialog, often under the guise of completing a reCAPTCHA verification on fraudulent phishing pages. The infection chain typically involves the use of `mshta.exe` to launch a PowerShell script, which downloads a .NET payload from a file hosting service. The Amatera Stealer DLL, packed with PureCrypter, is injected into the `MSBuild.exe` process, enabling the malware to harvest sensitive data from crypto-wallets, browsers, messaging apps, FTP clients, and email services. Advanced evasion techniques, such as WoW64 SysCalls and in-memory AMSI patching, are employed to bypass endpoint detection and response (EDR) and antivirus solutions. The Amatera Stealer, considered an evolution of the ACR Stealer, is available as a malware-as-a-service (MaaS) offering, with subscription plans ranging from $199 to $1,499. The campaigns also deploy NetSupport RAT for remote access and further exploitation. Notably, the PowerShell scripts used by Amatera check for the presence of valuable files or domain membership before proceeding, indicating a targeted approach. These findings highlight the increasing sophistication of social engineering and malware delivery tactics, as well as the growing threat posed by MaaS platforms to organizations and individuals alike.
Jul 12, 2026
Threat actors have significantly escalated the use of information-stealing malware and credential theft techniques, leveraging new methods to bypass traditional security controls and exploit human vulnerabilities. Flashpoint reports an 800% increase in infostealer-driven credential theft in 2025, with over 1.8 billion accounts compromised globally. Attackers are neutralizing Windows' Mark of the Web (MotW) protections using drag-and-drop lures, exploiting vulnerabilities, and targeting alternative software to evade detection. The rise of session token theft is also enabling attackers to bypass multi-factor authentication (MFA), as tokens stored in browsers are increasingly targeted and sold on underground markets, often escaping detection by network-focused security tools. The evolving threat landscape is further complicated by the proliferation of infostealer malware, which has become a primary entry point for enterprise breaches. Security experts emphasize the need for organizations to look beyond malware signatures and focus on deceptive initial access vectors, such as malicious scripts, third-party supply chain risks, and user manipulation. Effective defense now requires monitoring browser behavior, treating client-side security as a core responsibility, and understanding the full identity attack surface to counteract these sophisticated evasion tactics.
Jun 29, 2026