Loading story…
Between June 26 and July 9, 2025, the official Endgame Gear OP1w 4k v2 mouse configuration tool was compromised with the XRed backdoor. The malware enabled remote control, keylogging, and data exfiltration, affecting users who downloaded the tool from the product page. Endgame Gear has since removed the malware and issued remediation steps for affected users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are distributing the Guloader malware through phishing emails disguised as employee performance reports. These emails claim to provide information about staff evaluations and potential dismissals, enticing recipients to open a compressed RAR file attachment. The archive contains an executable file named to appear as a PDF document, which, when run, deploys Guloader. This malware then downloads and executes shellcode from a remote server, ultimately installing Remcos RAT on the victim's system. Remcos RAT enables attackers to perform a range of malicious activities, including keylogging, screenshot capture, webcam and microphone control, and the extraction of browser histories and passwords. The campaign leverages legitimate cloud storage services for command and control, increasing the difficulty of detection. Security researchers have provided indicators of compromise, such as specific MD5 hashes and C2 addresses, to aid in defense against this threat. Users are advised to exercise caution with unexpected emails and regularly update passwords to mitigate risk.
Jun 29, 2026
Attackers are distributing fake installers for the **Xeno Roblox script executor** through Discord communities, gaming forums, and compromised or impersonated accounts, luring players with claims of an "undetected" cheat tool. When victims run `xeno.exe`, the installer checks for Java, drops or installs a local Java runtime, retrieves validation data, and launches an obfuscated JAR masquerading as `decompiler.exe`, leading to a multi-stage infection chain tied to the previously documented **Powercat** malware family. The final payload combines an infostealer with a remote access trojan, stealing browser cookies and saved data, Discord and Roblox tokens, Minecraft data, payment details, and cryptocurrency wallet information. It also supports keylogging, screenshots, webcam capture, desktop streaming, file transfer and manipulation, PowerShell execution, and interactive remote shell access, while using anti-analysis checks, persistence via the Windows Run registry key under **"Display Calibration"**, and WebSocket-based command-and-control with self-update capability; researchers said the campaign has been active since the start of the year and poses particular risk to children and teenagers seeking Roblox cheats.
Aug 4, 2026
Multiple cybersecurity incidents have been reported involving the distribution of malware through the abuse of legitimate software and remote management tools. Attackers have exploited platforms such as LogMeIn Resolve, PDQ Connect, and the open-source SteamCleaner utility by disguising malware as legitimate installers or updates. In one case, users were tricked into downloading a malicious version of LogMeIn Resolve or PDQ Connect from websites mimicking legitimate software download pages, resulting in the installation of data-exfiltrating malware. Another campaign involved a backdoor malware signed with a valid certificate and disguised as the SteamCleaner tool, distributed via GitHub repositories and websites offering illegal software. These attacks highlight the increasing sophistication of threat actors in leveraging trusted tools to bypass security controls and gain persistent access to victim systems. The use of legitimate signatures and remote management tools allows attackers to evade traditional security products, as these tools are often whitelisted or considered benign in enterprise environments. Security researchers emphasize the need for enhanced monitoring of remote access tool usage, validation of software sources, and the implementation of behavioral detection mechanisms to identify abnormal activity associated with these tools. The campaigns demonstrate the importance of user awareness and the risks associated with downloading software from unofficial sources, as well as the necessity for organizations to maintain strict controls over the installation and execution of remote management utilities.
Jun 29, 2026