Chinese Malware Delivery Domains: Part III

This report details an ongoing campaign by a threat actor operating during Chinese time zone hours, targeting Chinese-speaking individuals and entities globally. Since June 2023, the actor has created over 2,800 domains for malware delivery, primarily targeting Windows systems through fake application download sites and update prompts. The actor has made operational changes, including anti-automation measures, reduced site tracker services, increased server distribution, and more discreet registration details. The campaign uses fake login pages, marketing apps, and cryptocurrency-related apps to distribute malware. The actor's motivations appear to be financially driven, potentially including credential theft, financial theft, and access brokering. The report emphasizes the importance of user awareness, enhanced security measures, and multi-layered defense strategies to counter this persistent threat.

• NanaZip 6.5 · DoSMediumVulnerability2026-08-18
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksHighVulnerability2026-10-23
• Microsoft: Windows Server 2016 reaches end of support in JanuaryNews2026-10-23
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23