ChainScript is a Node.js remote access trojan (RAT) identified by Blackpoint's Adversary Pursuit Group. It masquerades as legitimate software such as Spotify, Zoom Workplace, and Microsoft Teams via malicious Windows Installer packages. The malware uses a Polygon blockchain smart contract to dynamically discover its command and control (C2) infrastructure, allowing operators to rotate backend services without rebuilding agents. ChainScript offers extensive remote access features including shell access, file operations, screenshots, payload deployment, cryptocurrency wallet discovery, remote JavaScript execution, self-updating, and cleanup. Multiple builds with different names share the same core architecture.
A coordinated campaign involving 77 Firefox browser extensions has been identified, targeting cryptocurrency users by stealing wallet secrets and credentials. The campaign, named 'Offside Wallet Theft Factory,' includes 40 confirmed malicious extensions that exfiltrate sensitive data such as recovery phrases and private keys via Supabase-controlled remote switches, Cloudflare Workers, and hardcoded command-and-control infrastructure. An additional 37 extensions initially appeared benign but evolved into wallet-stealing malware. The operation ran from at least March 2026 through August 2026 and impersonated popular Web3 products like OKX, Rabby Wallet, and TronLink. The extensions use phishing interfaces, modified wallet code, and direct credential theft to enable immediate cryptocurrency theft and financial loss.
Vanta Stealer is a Python-based information stealer utilizing PyArmor protection and PyInstaller packaging to complicate defensive analysis. The malware systematically harvests credentials from Chromium-based browsers, communication platforms like Discord and Telegram, gaming applications including Steam, Riot Games, Roblox and Minecraft, cryptocurrency wallets, Mullvad VPN configurations, and sensitive documents. It performs token enrichment by validating stolen Discord credentials against the API to retrieve account details, billing information, Nitro status, and server privileges. The modular architecture downloads dedicated browser extraction utilities at runtime, maintains independence between collection modules, and generates structured inventory reports before consolidating harvested data into ZIP archives. Exfiltration occurs via HTTP POST to attacker-controlled infrastructure with victim metadata. Distribution likely occurs through social engineering campaigns involving phishing emails, trojanized...
A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully functional e-commerce projects with malicious code hidden using steganography inside SVG flag images. When developers run these projects, the malware deploys four-stage payloads aligned with OTTERCOOKIE: a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories were found with zero antivirus detections at the time of discovery, demonstrating the sophistication of this supply chain attack vector against software developers.
A sophisticated 64-bit information-stealing malware named Remus has emerged as a direct evolution of the notorious Lumma Stealer. Following the doxxing of alleged Lumma core members between August and October 2025, developers created this advanced variant, with test builds appearing in September 2025 and live campaigns starting February 2026. Remus employs innovative techniques including injecting custom 51-byte shellcode into browser memory to extract protected master keys, bypassing Application-Bound Encryption in Chromium-based browsers. The malware utilizes EtherHiding through Ethereum smart contracts for command-and-control resolution, making infrastructure takedowns nearly impossible. It targets browser credentials, session cookies, and cryptocurrency wallets while implementing rigorous anti-analysis checks to evade security research environments.
A sophisticated ClickFix campaign targets both Windows and macOS users through fake CAPTCHA pages that trick victims into executing malicious commands. The macOS variant deploys an AppleScript-based infostealer that harvests sensitive data including keychain databases, credentials, and session cookies from 12 browsers, over 200 browser extensions, and 16 cryptocurrency wallets. The malware employs a persistent, non-closable dialog box mimicking legitimate system prompts to force victims into providing their system password. Stolen session cookies enable attackers to bypass multi-factor authentication by hijacking active sessions. The campaign uses client-side JavaScript to filter victims by user-agent, directing desktop users to OS-specific payloads while ignoring mobile devices. Latest macOS updates include native terminal security warnings designed to alert users against pasting potentially malicious commands.