Loading story…
Recent research details a sophisticated NodeJS malware campaign distributing proxyware apps such as Infatica, Honeygain, earnFM, and PacketLab. The malware leverages obfuscated scripts, scheduled tasks, and malicious Chrome extensions to establish persistence, evade detection, and monetize infected systems by sharing network resources. Command-and-control infrastructure, registry modifications, and credential theft mechanisms are also documented, with extensive IOCs provided for defenders.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
SC Media reported that Formbook malware was being distributed through separate phishing campaigns. This appears to be a distinct development from the Eurasian ComicForm and SectorJ149 activity because the provided content does not indicate they are the same campaign.
Walmart Global Tech researchers published analysis of NodeJS backdoors used to deliver proxyware and other monetization schemes. No separate discovery or campaign date is given in the provided content.
SC Media reported that True World Group was allegedly breached by the Lynx ransomware operation. The available content does not provide a more specific incident date than the article publication date.
The Hacker News reported that ComicForm and SectorJ149 were deploying Formbook malware in cyberattacks targeting Eurasian entities. With no earlier event date stated in the provided content, the report date is used.
SC Media reported a new North Korean ClickFix campaign distributing an updated BeaverTail malware payload. No additional timing details are provided beyond the publication date.
PolySwarm published research on a threat or malware variant it called "HybridPetya." The provided reference includes no further incident details, so the publication itself is the only distinct event that can be established from the content.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemedium.com
Open sourceblog.polyswarm.io
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple active malware campaigns are using **social engineering** and **trojanized content** to compromise Windows systems, with lures ranging from pirated software downloads to business and shipping documents. AhnLab reported a “proxyjacking” operation attributed to **Larva-25012** that distributes fake installers (notably a trojanized *Notepad++* package) via cracked-software sites; the `Setup.zip` bundle includes a legitimate `Setup.exe` plus a malicious sideloaded DLL (`TextShaping.dll`) that decrypts and installs **DPLoader** for persistent command retrieval and follow-on payload delivery. The malware also tampers with defenses by changing Microsoft Defender settings (e.g., exclusions, reduced notifications, and blocking sample submission) to reduce detection while monetizing victims’ bandwidth through installed **proxyware**. Separately, FortiGuard Labs described a Russia-focused, multi-stage intrusion chain that abuses trusted services (**GitHub** and **Dropbox**) for payload hosting and weaponizes **Defendnot** (a Windows Security Center trust-model research tool) to disable **Microsoft Defender** before deploying a ransomware payload. Fortinet also documented phishing campaigns using weaponized shipping-themed Word documents to deliver **Remcos RAT**, including fileless execution behavior and exploitation of `CVE-2017-11882` (Microsoft Equation Editor) via remotely fetched templates. These campaigns reinforce the operational risk from user-driven execution paths (pirated installers and document lures), “living off the land” techniques, and defense evasion through both policy tampering and security tooling abuse.
Jun 29, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Researchers linked **Nodersok**—also tracked as **Novter** and **Divergent**—to the long-running **KovCoreG** malvertising operation, which used fake Adobe Flash update lures and compromised ads on popular websites to infect Windows systems. The multi-stage chain abused legitimate tools including `mshta.exe`, PowerShell, `node.exe`, and **WinDivert**, fetched RC4-encrypted payloads from short-lived infrastructure and CDN services such as Cloudfront and Cdn77, and ran largely in memory using HTA execution, registry-based staging, and reflective PE injection. The malware also attempted to disable **Windows Defender** and **Windows Update**, bypassed UAC through **CMSTPLUA**, and established persistence through registry Run keys and scheduled tasks. The final payload turned infected hosts into proxy zombies and click-fraud nodes, with Node.js-based modules supporting **SOCKS4A** relaying and fraudulent ad traffic disguised as Android or iOS devices through TCP/IP and SYN packet manipulation. Additional modules supported traffic blocking and technical-support scam activity, while anti-analysis checks and encrypted command-and-control updates helped the operators keep the campaign active and evolving. Microsoft said the operation hit thousands of systems, mostly consumer devices in the United States and Europe, with some enterprise victims across sectors including education, healthcare, finance, retail, and professional services.
Aug 15, 2026