Threats Tagged 'boundsiphon'

Two previously undocumented .NET malware components were delivered through a ClickFix infection chain. RemotePanel establishes persistent remote access by masquerading as the Windows Time service, providing operators with PowerShell control, file and process management, screen access, modular HVNC, and fleet management capabilities. It uses a BNB Smart Chain contract to dynamically resolve its active Command and Control server, enabling infrastructure rotation without rebuilding the RAT. BoundSiphon runs primarily from memory, targeting browser credentials and sessions, cryptocurrency wallets, password manager data, and documents, including secrets protected by Chromium App-Bound Encryption. Strong code overlap exists between BoundSiphon and a stealer previously documented by Socket, linking the sample to an earlier stealer codebase. The modular design separates persistent access from data theft, allowing operators to replace infrastructure and individual components while maintaining operational capabilities.