The Yoba malware campaign distributes cryptocurrency mining malware by abusing digitally signed AI application executables from OpenAI and Anthropic to evade detection. It uses DLL sideloading with malicious DLLs loaded alongside legitimate signed binaries. The infection chain includes YobaDropper and YobaLoader components that employ anti-analysis techniques such as process verification, execution delays, and regional language exclusions. Command and control communication uses Telegram profile images, domain generation algorithms, DNS over HTTPS via Google, and public hosting services to retrieve encrypted payloads. While primarily observed deploying the XMRig miner, the loader architecture can support additional Windows executables and PowerShell payloads, indicating potential expansion beyond cryptojacking.
KGB RAT is a Windows Remote Access Trojan actively marketed on underground forums since late 2025. It is sold as Malware-as-a-Service with prices ranging from $150 to $800. The malware includes features such as credential theft, keylogging, hidden desktop takeover, ransomware, and psychological harassment tools like screamers and forced blue screens. It uses a daily updated fully undetectable (FUD) crypter to evade detection by Windows Defender and communicates with its command and control (C2) servers without requiring port forwarding. Notifications are delivered via Telegram. The malware is based on the NjRAT framework and includes a CryptoClipper module that swaps cryptocurrency wallet addresses. Development reportedly began in early 2022.
Analysis reveals HEAVYGRAM, a multi-stage Windows backdoor attributed to Iran-linked threat actor Handala Hack, deployed since Fall 2023 targeting Iranian dissidents, journalists, and government opponents. The surveillance tool uses Telegram bot API for command-and-control operations, enabling remote command execution, screen capture, data exfiltration, and persistent access. Victims receive social-engineered files masquerading as legitimate applications like Telegram, KeePass, or Pictory. The implant supports DLL side-loading, registry persistence, and system reconnaissance. Infrastructure analysis identified 29 samples utilizing networks of Telegram bots and groups for operations. The malware aligns with activity disclosed by U.S. Department of Justice regarding Iran's Ministry of Intelligence and Security infrastructure seizures, with tradecraft including Vultr Object Storage and Persian-language decoys targeting specific victim profiles including academics and media personnel.
This analysis examines a sophisticated Vidar infostealer variant that employs a custom virtual machine to obfuscate its malicious code through proprietary bytecode interpretation. The malware implements extensive anti-analysis measures including debugger detection via NtQueryInformationProcess and RDTSC timing checks, sandbox evasion by identifying antivirus processes and checking system resources, and environment fingerprinting. Vidar targets credentials from web browsers including Chromium and Gecko-based extensions, Azure authentication tokens, FileZilla FTP credentials, and captures screenshots. It utilizes SeDebugPrivilege for elevated access, creates hidden desktops for browser automation, and exfiltrates stolen data through Telegram channels. The malware performs cleanup operations to remove execution artifacts and proxies DLL execution through rundll32.exe to blend with legitimate Windows processes.
A new modular macOS information stealer named ClickLock Stealer has been discovered targeting users primarily in Europe, North America, and the Middle East. The malware is likely distributed via ClickFix social engineering pages that trick victims into pasting malicious commands into Terminal. Once executed, it deploys four components: a credential stealer, a Keychain stealer targeting Chrome's encryption key, a comprehensive crypto wallet harvester, and a persistent GSocket-based backdoor. The malware employs an aggressive 'locker' technique, killing all visible applications except password dialogs to force user compliance. It targets data from eight browsers, 31 crypto wallet extensions, seven password managers, desktop wallets, macOS Keychain, and shell history. The campaign has compromised at least 100 victims across 33 countries since May 2026, using compromised WordPress domains and Telegram for command and control and exfiltration.
A sophisticated Rust-based macOS implant named macOS.Gaslight has been discovered, featuring a novel 3.5 KB prompt-injection payload containing 38 fabricated system messages designed to disrupt LLM-assisted malware analysis. The backdoor communicates via Telegram Bot API with AES-GCM encrypted payloads over certificate-pinned TLS and includes self-redaction capabilities to hide its bot token from logs. It provides operators with an interactive shell, system information collection, and credential stealing capabilities through a bundled Python script that targets browser data, keychains, and command histories. The implant uses runtime-fetched CPython interpreters and establishes persistence through a LaunchAgent masquerading as an Apple system service. This threat is assessed with high confidence to be aligned with DPRK activity and represents a significant evolution in adversarial techniques targeting security analysts rather than sandbox environments.
