RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser Theft

RemotePanel and BoundSiphon are two previously undocumented .NET malware components delivered via a ClickFix infection chain. RemotePanel masquerades as the Windows Time service to establish persistent remote access, offering operators PowerShell control, file and process management, screen access, modular hidden VNC, and fleet management. It uses a BNB Smart Chain contract to dynamically resolve its active command and control server, enabling infrastructure rotation without rebuilding the RAT. BoundSiphon operates primarily in memory, targeting browser credentials, sessions, cryptocurrency wallets, password manager data, and documents protected by Chromium App-Bound Encryption. The modular design separates persistent access from data theft, allowing operators to swap components independently while maintaining operational capabilities. No known active exploitation or patches are reported.

• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• Email threat landscape: Q3 2026 trends and insightsAnalysis2026-11-05
• Grand Theft Auto VI Release Phishing LuresMalware2026-11-05