mediafire

Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillance on Android and iOS devices. "The developer runs dedicated channels for sales, customer support, and regular updates, giving buyers a single point of access to a fully operational spyware panel," Daniel Kelley, security researcher at iVerify, said. "The platform goes beyond typical data collection into real-time surveillance and direct financial theft." ZeroDayRAT is designed to support Android versions 5 through 16 and iOS versions up to 26. It's assessed that the malware is distributed via social engineering or fake app marketplaces. The malicious binaries are generated through a builder that's provided to buyers along with an online panel that they can set up on their own server. Once the malware infects a device, the operator gets to see all the details, including model, location, operating system, battery status, SIM, carrier details, app usage, notifications, and a preview of recent SMS messages, through a self-hosted panel. This information allows the threat actor to profile the victim and glean more about who they talk to and the apps they use the most. The panel also extracts their current GPS coordinates and plots them on Google Maps, along with the history of all locations they have been to over time, effectively turning it into spyware. "One of the more problematic panels is the accounts tab," Kelley added. "Every account registered on the device is enumerated: Google, WhatsApp, Instagram, Facebook, Telegram, Amazon, Flipkart, PhonePe, Paytm, Spotify, and more, each with its associated username or email." Some of the other capabilities of ZeroDayRAT include logging keystrokes, gathering SMS messages -- including one-time passwords (OTPs) to defeat two-factor authentication, as well as allowing hands-on operations, such as activating real-time surveillance via live camera streaming and a microphone feed that allows the adversary to remotely monitor a victim. To enable financial theft, the malware incorporates a stealer component that scans for wallet apps like MetaMask, Trust Wallet, Binance, and Coinbase, and substitutes wallet addresses copied to the clipboard to reroute transactions to a wallet under the attacker's control. There also exists a bank stealer module to target online mobile wallet platforms like Apple Pay, Google Pay, PayPal, along with PhonePe, an Indian digital payments application that allows instant money transfers with the Unified Payments Interface (UPI), a protocol to facilitate inter-bank peer-to-peer and person-to-merchant transactions. "Taken together, this is a complete mobile compromise toolkit, the kind that used to require nation-state investment or bespoke exploit development, now sold on Telegram," Kelley said. "A single buyer gets full access to a target's location, messages, finances, camera, microphone, and keystrokes from a browser tab. Cross-platform support and active development make it a growing threat to both individuals and organizations." The ZeroDayRAT malware is similar to numerous others that have targeted mobile device users, either via phishing or by infiltrating official app marketplaces. Over the past few years, bad actors have repeatedly managed to find various ways to bypass security protections put in place by Apple and Google to trick users into installing malicious apps. Attacks targeting Apple's iOS have typically leveraged an enterprise provisioning capability that allows organizations to install apps without the need for publishing them to the App Store. By marketing tools that combine spyware, surveillance, and information-stealing capabilities, they further lower the barrier of entry for less skilled hackers. They also highlight the evolving sophistication and persistence of mobile-focused cyber threats. News of the commercial spyware platform coincides with the emergence of various mobile malware and scam campaigns that have come to light in recent weeks - An Android remote access trojan (RAT) campaign has used Hugging Face to host and distribute malicious APK files. The infection chain begins when users download a seemingly harmless dropper app (e.g., TrustBastion) that, when opened, prompts users to install an update, which causes the app to download the APK file hosted on Hugging Face. The malware then requests accessibility permissions and access to other sensitive controls to enable surveillance and credential theft. An Android RAT called Arsink has been found to use Google Apps Script for media and file exfiltration to Google Drive, in addition to relying on Firebase and Telegram for C2. The malware, which allows data theft and complete remote control, is distributed via Telegram, Discord, and MediaFire links, while impersonating various popular brands. Arsink infections have been concentrated in Egypt, Indonesia, Iraq, Yemen, and Türkiye. A document reader app named All Document Reader (package name: com.recursivestd.highlogic.stellargrid) uploaded to the Google Play Store has been flagged for acting as an installer for the Anatsa (aka TeaBot and Toddler) banking trojan. The app attracted over 50,000 downloads before it was taken down. An Android banking trojan called deVixor has been actively targeting Iranian users through phishing websites that impersonate legitimate automotive businesses since October 2025. Besides harvesting sensitive information, the malware includes a remotely triggered ransomware module capable of locking devices and demanding cryptocurrency payments. It uses Google Firebase for command delivery and Telegram-based bot infrastructure for administration. A malicious campaign codenamed ShadowRemit has exploited fake Android apps and pages mimicking Google Play app listings to enable unlicensed cross-border money transfers. These bogus pages have been found to promote unauthorized APKs as trusted remittance services with zero fees and improved exchange rates. "Victims are instructed to send payments to beneficiary accounts/eWallet endpoints and provide transaction screenshots as proof for verification," CTM360 said. "This approach can bypass regulated remittance corridors and aligns with mule-account collection patterns." An Android malware campaign targeting users in India has abused the trust associated with government services and official digital platforms to distribute malicious APK files through WhatsApp, leading to the deployment of malware that can steal data, establish persistent control, and run a cryptocurrency miner. The operators of an Android trojan and cybercrime tool called Triada have been observed using phishing landing pages disguised as Chrome browser updates to trick users into downloading malicious APK files hosted on GitHub. According to an analysis by Alex, attackers are "actively taking over long-standing, fully verified advertiser accounts to distribute malicious redirects." A WhatApp-oriented scam campaign has leveraged video calls, in which the threat actor poses as a bank representative or a Meta support and instructs them to share their phone's screen to address a purported unauthorized charge on their credit card, and install a legitimate remote access app, such as AnyDesk or TeamViewer, to steal sensitive data. An Android spyware campaign has leveraged romance scam tactics to target individuals in Pakistan to distribute a malicious dating chat app dubbed GhostChat to exfiltrate victims' data. It's currently not known how the malware is distributed. The threat actors behind the operation are also suspected to be running a ClickFix attack that infects victims' computers with a DLL payload that can gather system metadata and run commands issued by an external server, as well as a WhatsApp device-linking attack called GhostPairing to gain access to their WhatsApp accounts. A new family of Android click fraud trojans called Phantom has been found to leverage TensorFlow.js, a JavaScript machine learning library, to automatically detect and interact with specific advertisement elements on a site loaded in a hidden WebView. An alternative "signaling" mode uses WebRTC to stream a live video feed of the virtual browser screen to the attackers' server and allow them to click, scroll, or enter text. The malware is distributed via mobile games published to Xiaomi's GetApps store and other unofficial, third-party app stores. An Android malware family called NFCShare has been distributed via a Deutsche Bank phishing campaign to deceive users into installing a malicious APK file ("deutsche.apk") under the pretext of an update, which reads NFC card data and exfiltrates it to a remote WebSocket endpoint. The malware shares similarities with NFC relay malware families like NGate, ZNFC, SuperCard X, PhantomCard, and RelayNFC, with its command-and-control (C2) server previously flagged as associated with SuperCard X activity in November 2025. In a report published last month, Group-IB said it has witnessed a surge in NFC-enabled Android tap-to-pay malware, most of which is advertised within Chinese cybercrime communities on Telegram. The NFC-based relay technique is also referred to as Ghost Tap. "At least $355,000 in illegitimate transactions have been recorded from one POS vendor alone throughout November 2024 – August 2025," the Singapore-headquartered cybersecurity company said. "In another observed scenario, mobile wallets preloaded with compromised cards are used by mules across the globe to make purchases." Group-IB also said it identified three major vendors of Android NFC relay apps, including TX-NFC, X-NFC, and NFU Pay, with TX-NFC amassing over 25,000 subscribers on Telegram since commencing operations in early January 2025. X-NFC and NFU Pay have more than 5,000 and 600 subscribers on the messaging platform, respectively. The end goal of these attacks is to trick victims into installing NFC-enabled malware and tapping their physical payment cards on their smartphone, causing the transaction data to be captured and relayed to the cybercriminal's device through an attacker-controlled server. Once the card details are exfiltrated, a dedicated app installed on the money mule's device is used to complete payments or cash-out as though the victims' cards were physically present. Calling tap-to-pay scams a growing concern, Group-IB said it observed a steady increase in the detection of malware artifacts between May 2024 and December 2025. "At the same time, different families and variants are also appearing, while the old ones remain active," it added. "This indicates the spread of this technology among fraudsters."

Cybersecurity researchers have discovered malware campaigns using the now-prevalent ClickFix social engineering tactic to deploy Amatera Stealer and NetSupport RAT. The activity, observed this month, is being tracked by eSentire under the moniker EVALUSION. First spotted in June 2025, Amatera is assessed to be an evolution of ACR (short for "AcridRain") Stealer, which was available under the malware-as-a-service (MaaS) model until sales of the malware were suspended in mid-July 2024. Amatera is available for purchase via subscription plans that go from $199 per month to $1,499 for a year. "Amatera provides threat actors with extensive data exfiltration capabilities targeting crypto-wallets, browsers, messaging applications, FTP clients, and email services," the Canadian cybersecurity vendor said. "Notably, Amatera employs advanced evasion techniques such as WoW64 SysCalls to circumvent user-mode hooking mechanisms commonly used by sandboxes, Anti-Virus solutions, and EDR products." As is typically the case with ClickFix attacks, users are tricked into executing malicious commands using the Windows Run dialog in order to complete a reCAPTCHA verification check on bogus phishing pages. The command initiates a multi-step process that involves using the "mshta.exe" binary to launch a PowerShell script that's responsible for downloading a .NET downloaded from MediaFire, a file hosting service. The payload is the Amatera Stealer DLL packed using PureCrypter, a C#-based multi-functional crypter and loader that's also advertised as a MaaS offering by a threat actor named PureCoder. The DLL is injected into the "MSBuild.exe" process, following which the stealer harvests sensitive data and contacts an external server to execute a PowerShell command to fetch and run NetSupport RAT. "What is particularly noteworthy in the PowerShell invoked by Amatera is a check to determine if the victim machine is part of a domain or has files of potential value, e.g., crypto wallets," eSentire said. "If neither is found, NetSupport is not downloaded." The development dovetails with the discovery of several phishing campaigns propagating a wide range of malware families - Emails containing Visual Basic Script attachments that masqueraded as invoices to deliver XWorm by means of a batch script that invokes a PowerShell loader Compromised websites injected with malicious JavaScript that redirects site visitors to bogus ClickFix pages mimicking Cloudflare Turnstile checks to deliver NetSupport RAT as part of an ongoing campaign codenamed SmartApeSG (aka HANEYMANEY and ZPHP) Using fake Booking.com sites to display fake CAPTCHA checks that employ ClickFix lures to run a malicious PowerShell command that drops a credential stealer when executed via the Windows Run dialog Emails spoofing internal "email delivery" notifications that falsely claim to have blocked important messages related to outstanding invoices, package deliveries, and Request for Quotations (RFQs) in order to trick recipients into clicking on a link that siphons login credentials under the pretext of moving the messages to the inbox Attacks using phishing kits named Cephas (which first emerged in August 2024) and Tycoon 2FA to lead users to malicious login pages for credential theft "What makes Cephas noteworthy is that it implements a distinctive and uncommon obfuscation technique," Barracuda said in an analysis published last week. "The kit obscures its code by creating random invisible characters within the source code that help it evade anti-phishing scanners and obstruct signature-based YARA rules from matching the exact phishing methods."

A malicious network of YouTube accounts has been observed publishing and promoting videos that lead to malware downloads, essentially abusing the popularity and trust associated with the video hosting platform for propagating malicious payloads. Active since 2021, the network has published more than 3,000 malicious videos to date, with the volume of such videos tripling since the start of the year. It has been codenamed the YouTube Ghost Network by Check Point. Google has since stepped in to remove a majority of these videos. The campaign leverages hacked accounts and replaces their content with "malicious" videos that are centred around pirated software and Roblox game cheats to infect unsuspecting users searching for them with stealer malware. Some of these videos have racked up hundreds of thousands of views, ranging from 147,000 to 293,000. "This operation took advantage of trust signals, including views, likes, and comments, to make malicious content seem safe," Eli Smadja, security research group manager at Check Point, said. "What looks like a helpful tutorial can actually be a polished cyber trap. The scale, modularity, and sophistication of this network make it a blueprint for how threat actors now weaponize engagement tools to spread malware." The use of YouTube for malware distribution is not a new phenomenon. For years, threat actors have been observed hijacking legitimate channels or using newly created accounts to publish tutorial-style videos with descriptions pointing to malicious links that, when clicked, lead to malware. These attacks are part of a broader trend where attackers repurpose legitimate platforms for nefarious purposes, turning them into an effective avenue for malware distribution. While some of the campaigns have abused legitimate ad networks, such as those associated with search engines like Google or Bing, others have capitalized on GitHub as a delivery vehicle, as in the case of the Stargazers Ghost Network. One of the main reasons why Ghost Networks has taken off in a big way is that they can not only be used to amplify the perceived legitimacy of the links shared, but also maintain operational continuity even when the accounts are banned or taken down by the platform owners, thanks to their role-based structure. "These accounts take advantage of various platform features, such as videos, descriptions, posts (a lesser-known YouTube feature similar to Facebook post), and comments to promote malicious content and distribute malware, while creating a false sense of trust," security researcher Antonis Terefos said. "The majority of the network consists of compromised YouTube accounts, which, once added, are assigned specific operational roles. This role-based structure enables stealthier distribution, as banned accounts can be rapidly replaced without disrupting the overall operation." There are three specific types of accounts - Video-accounts, which upload phishing videos and provide descriptions containing links to download the advertised software (alternatively, the links are shared as a pinned comment or provided directly in the video as part of the installation process) Post-accounts, which are responsible for publishing community messages and posts containing links to external sites Interact-accounts, which like and post encouraging comments to give the videos a veneer of trust and credibility The links direct users to a wide range of services like MediaFire, Dropbox, or Google Drive, or phishing pages hosted on Google Sites, Blogger, and Telegraph that, in turn, incorporate links to download the supposed software. In many of these cases, the links are concealed using URL shorteners to mask the true destination. It's currently not known if all these videos and hijacked accounts are the work of a single threat actor, or it's some sort of a distribution-as-a-service (DaaS) that other cybercriminals can lease access to distribute their warez. "The network appears to be operating as a collective, with different threat actors distributing their malware through those accounts," Check Point told The Hacker News. "We have no clear evidence that there is a single threat actor — there could be multiple actors who have adopted this method of operation." "Although all of the videos share similar descriptions and formats, if there are additional threat actors involved, they may have 'copied' or been inspired by the original operator's modus operandi." Some of the malware families distributed via the YouTube Ghost Network include Lumma Stealer, Rhadamanthys Stealer, StealC Stealer, RedLine Stealer, Phemedrone Stealer, and other Node.js-based loaders and downloaders - A channel named @Sound_Writer (9,690 subscribers), which has been compromised for over a year to upload cryptocurrency software videos to deploy Rhadamanthys A channel named @Afonesio1 (129,000 subscribers), which was compromised on December 3, 2024, and January 5, 2025, to upload a video advertising a cracked version of Adobe Photoshop to distribute an MSI installer that deploys Hijack Loader, which then delivers Rhadamanthys "The ongoing evolution of malware distribution methods demonstrates the remarkable adaptability and resourcefulness of threat actors in bypassing conventional security defenses," Check Point said. "Adversaries are increasingly shifting toward more sophisticated, platform-based strategies, most notably, the deployment of Ghost Networks." "These networks leverage the trust inherent in legitimate accounts and the engagement mechanisms of popular platforms to orchestrate large-scale, persistent, and highly effective malware campaigns." (The story was updated after publication on October 28, 2025, to include a response from Check Point.)

A financially motivated threat actor codenamed UNC5142 has been observed abusing blockchain smart contracts as a way to facilitate the distribution of information stealers, such as Atomic (AMOS), Lumma, Rhadamanthys (aka RADTHIEF), and Vidar, targeting both Windows and Apple macOS systems. "UNC5142 is characterized by its use of compromised WordPress websites and 'EtherHiding,' a technique used to obscure malicious code or data by placing it on a public blockchain, such as the BNB Smart Chain," Google Threat Intelligence Group (GTIG) said in a report shared with The Hacker News. As of June 2025, Google said it flagged about 14,000 web pages containing injected JavaScript that exhibit behavior associated with an UNC5142, indicating indiscriminate targeting of vulnerable WordPress sites. However, the tech giant noted that it has not spotted any UNC5142 activity since July 23, 2025, either signaling a pause or an operational pivot. EtherHiding was first documented by Guardio Labs in October 2023, when it detailed attacks that involved serving malicious code by utilizing Binance's Smart Chain (BSC) contracts via infected sites serving fake browser update warnings. A crucial aspect that underpins the attack chains is a multi-stage JavaScript downloader dubbed CLEARSHORT that enables the distribution of the malware via the hacked sites. The first stage is a JavaScript malware that's inserted into the websites to retrieve the second-stage by interacting with a malicious smart contract stored on the BNB Smart Chain (BSC) blockchain. The first stage malware is added to plugin-related files, theme files, and, in some cases, even directly into the WordPress database. The smart contract, for its part, is responsible for fetching a CLEARSHORT landing page from an external server that, in turn, employs the ClickFix social engineering tactic to deceive victims into running malicious commands on the Windows Run dialog (or the Terminal app on Macs), ultimately infecting the system with stealer malware. The landing pages, typically hosted on a Cloudflare .dev page, are retrieved in an encrypted format as of December 2024. On Windows systems, the malicious command entails the execution of an HTML Application (HTA) file downloaded from a MediaFire URL, which then drops a PowerShell script to sidestep defenses, fetch the encrypted final payload from either GitHub or MediaFire, or their own infrastructure in some cases, and run the stealer directly in memory without writing the artifact to disk. In attacks targeting macOS in February and April 2025, the attackers have been found to utilize ClickFix decoys to prompt the user to run a bash command on Terminal that retrieved a shell script. The script subsequently uses the curl command to obtain the Atomic Stealer payload from the remote server. CLEARSHORT is assessed to be a variant of ClearFake, which was the subject of an extensive analysis by French cybersecurity company Sekoia in March 2025. ClearFake is a rogue JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique. It's known to be active since July 2023, with the attacks adopting ClickFix around May 2024. The abuse of blockchain offers several advantages, as the clever technique not only blends in with legitimate Web3 activity, but also increases the resiliency of UNC5142's operations against detection and takedown efforts. Google said the threat actor's campaigns have witnessed considerable evolution over the past year, shifting from a single-contract system to a more sophisticated three-smart contract system beginning in November 2024 for better operational agility, with further refinements observed earlier this January. "This new architecture is an adaptation of a legitimate software design principle known as the proxy pattern, which developers use to make their contracts upgradable," it explained. "The setup functions as a highly efficient Router-Logic-Storage architecture where each contract has a specific job. This design allows for rapid updates to critical parts of the attack, such as the landing page URL or decryption key, without any need to modify the JavaScript on compromised websites. As a result, the campaigns are much more agile and resistant to takedowns." UNC5142's accomplishes this by taking advantage of the mutable nature of a smart contract's data (it's worth noting that the program code is immutable once it's deployed) to alter the payload URL, costing them anywhere between $0.25 and $1.50 in network fees to perform these updates. Further analysis has determined the threat actor's use of two distinct sets of smart contract infrastructures to deliver stealer malware via the CLEARSHORT downloader. The Main infrastructure is said to have been created on November 24, 2024, whereas the parallel Secondary infrastructure was funded on February 18, 2025. "The Main infrastructure stands out as the core campaign infrastructure, marked by its early creation and steady stream of updates," GTIG said. "The Secondary infrastructure appears as a parallel, more tactical deployment, likely established to support a specific surge in campaign activity, test new lures, or simply build operational resilience." "Given the frequent updates to the infection chain coupled with the consistent operational tempo, high volume of compromised websites, and diversity of distributed malware payloads over the past year and a half, it is likely that UNC5142 has experienced some level of success with their operations."