Malware & Criminal Tooling Intelligence
New malware families, crimeware updates, loader/dropper campaigns, C2 infrastructure, and initial access broker tooling emerging from criminal underground channels.
Malware & Criminal Tooling — Archive & Latest
CWPdoor, Lindnor & ARTEX: OTX Pulse Analysis — Linux Backdoors, Ransomware Tooling and Autonomous Intrusion Frameworks
Three live OTX pulses reveal passive Linux backdoors in CWP, ransomware-linked security killers, and AI-driven infrastructure targeting financial institutions. Immediate detection advised.
Haiou Jailbreak Bundle: Prompt Adware Targets Codex LLM Gateways via Cobalt Strike & Ladon Tooling — OTX Pulse Analysis & Detection Pack
Check Point Research flags the Haiou jailbreak bundle: prompt adware that hijacks OpenAI Codex configs, weakens guardrails, and injects ads for a rogue LLM gateway. Hunt now.
ClingSTUN IoT Botnet + Fake-Download Monetization Campaign: STUN C2 Abuse and Trojanized Installer Detection Pack
OTX pulses reveal ClingSTUN exploiting IoT CVEs with STUN-protocol C2 disguise, plus a fake-download campaign dropping WorldProxyPool and monetization payloads. Hunt now.
StyleSmuggler PSK Agent RAT, Yoba Cryptominer Loader & AD CS ESC1/ESC8 Abuse: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal active exploitation of Magento stores via CVE-2026-75650 deploying PSK Agent RAT, signed-AI-app cryptomining (Yoba/XMRig), and human-operated AD CS ESC1/ESC8 intrusions. Retail and identity infrastructure at critical risk.
Malicious Claude Code Extension in Cursor IDE + AD CS ESC1/ESC8 Exploitation: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose malicious Cursor IDE extensions deploying SSH backdoors and human-operated intrusions leveraging Teams phishing, Quick Assist abuse, and AD CS ESC1/ESC8 attacks. Enterprise detection and response guidance provided.
AnimateClipper, ZigClipper & CryptoBandit Clipbanker Campaign: OTX Pulse Analysis — Clipboard Hijacking Detection Pack
Active clipbanker campaign (AnimateClipper, ZigClipper, Efimer, CryptoBandit) hijacking crypto payments via clipboard substitution and ClickFix lures. URGENT: block IOCs, hunt execution artifacts.
BPFDoor/AVERAT Edge Network Implants + Kong RAT SEO Poisoning + Multi-Family Crypto Clippers: OTX Pulse Analysis
Critical OTX pulses reveal sophisticated edge device implants (BPFDoor/AVERAT) targeting telecoms, Kong RAT delivered via SEO poisoning, and widespread crypto clipboard hijackers. Immediate detection engineering required.
Supply Chain Wallet Drainers, SEO-Poisoned RATs, and ClipBanker Infrastructure: OTX Pulse Analysis — Enterprise Detection Pack
Live OTX intelligence reveals active cryptocurrency theft campaigns using supply chain compromise, SEO poisoning delivering Kong RAT, and ClipBanker malware targeting financial transactions.
Coruna/DarkSword iOS Exploit Frameworks & Polymarket Supply-Chain Wallet Drainer: OTX Pulse Analysis — Enterprise Detection Pack
Coruna iOS exploit framework evolves with DarkSword chains targeting WebKit vulnerabilities; Polymarket compromised via third-party script injecting cryptocurrency wallet-draining code. Immediate patching and script integrity validation required.
ScreenConnect RAT + ValleyRAT Crypto Fraud + Telerik Exploitation: OTX Pulse Analysis — Enterprise Detection Pack
Three active campaigns detected: trojanized ScreenConnect installers via Adobe lures, ValleyRAT targeting Korean firms with crypto fraud, and Blue Mockingbird exploiting CVE-2019-18935 to deploy Godzilla webshells. High urgency.
YobaLoader + Overlord RAT DLL Sideloading Wave: OTX Pulse Analysis — Fake AI Tools, VBScript Banking Trojans & CMS.exe Compromise
Three active campaigns abuse DLL sideloading: fake signed ChatGPT/Claude installers (Yoba/XMRig), VBScript banking trojans hitting Brazil/Portugal, and CMS.exe compromise.
Gheist Campaign: PolinRider Malware Abuses Stolen GitHub Tokens for Mass Secret Exfiltration — OTX Pulse Analysis
Automated Gheist campaign abuses compromised GitHub tokens to commit malicious sync-check workflows across 13,500+ branches, exfiltrating repository secrets. Immediate credential rotation required.
Magento Magecart Loader 'deepveindrilling' + Gheist GitHub Token Abuse: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal a Magecart-style loader compromising 953 Magento stores and the Gheist campaign abusing stolen GitHub tokens at scale. High urgency for retail and DevOps teams.
SilentXMRMiner On-Endpoint Compilation via Samsung MagicINFO CVE-2025-4632: OTX Pulse Analysis — Rogue AnyDesk, 'oldadministrator' Persistence & Monero Mining Detection Pack
Threat actor exploits Samsung MagicINFO (CVE-2025-4632), deploys rogue AnyDesk, creates 'oldadministrator' admin account, and compiles SilentXMRMiner directly on endpoints. Hunt now.
PHP2Shell CVE-2026-109618/109619 Pre-Patch Leak, VelvetCake PowerShell RAT (Opal Sleet / Konni), and RatHat Android Intrusion Campaign: OTX Pulse Analysis — Enterprise Detection Pack
Live OTX pulses expose leaked PHP RCE flaws under active scan, DPRK-linked VelvetCake PowerShell malware hitting Ukraine-focused orgs, and RatHat Android RAT. Act now.
BlueHammer (CVE-2026-33825): Eight-Stage Windows Defender Privilege Escalation Chain — OTX Pulse Analysis & Enterprise Detection Pack
BlueHammer (CVE-2026-33825) chains Defender update RPC, offline SAM parsing, and LSASS theft for SYSTEM access. Patch 4.18.26030.3011 now — hunt immediately.
Midnight Mimosa Android Firmware Supply-Chain Campaign: Phantom, Joker, and DxFactory Loader Detection Pack
High urgency: Midnight Mimosa embeds platform-signed Android loaders in MediaTek firmware for ad fraud and residential-proxy abuse across 150+ countries.
WHIPSHOT & SLAPSHOT Webshells via Chained NetScaler CVE-2026-88771 / CVE-2026-88779: OTX Pulse Analysis — Edge Device Detection Pack
OTX pulse confirms active intrusions chaining CVE-2026-88771 and CVE-2026-88779 against NetScaler ADC 14.1, deploying WHIPSHOT/SLAPSHOT PHP webshells. Patch and hunt now.
AOMEI Backupper Supply Chain Hijack — upgrade-now.exe Backdoor: OTX Pulse Analysis & Enterprise Detection Pack
AOMEI Backupper update infrastructure compromised April–July 2026, pushing upgrade-now.exe RAT via storage-data.com to 100M+ users. High urgency — hunt now.
Suo5 HTTP/HTTPS Tunneling via Compromised IIS Web Servers: OTX Pulse Analysis — Pivot Detection & Hunting Pack
OTX pulse details Suo5 SOCKS5 tunneling tool deployed on compromised IIS/.NET web servers for internal network pivoting. Detection rules, hunt queries, and response guidance inside.
ChainScript Node.js RAT Leverages Polygon Blockchain for C2 via ClickFix Lures: OTX Pulse Analysis — Enterprise Detection Pack
Blackpoint APG uncovers ChainScript, a Node.js RAT using EtherHiding-style Polygon smart contracts for C2 discovery, spread via ClickFix lures and trojanized MSI installers masquerading as Spotify, Zoom, and Teams. High urgency.
NetSupport RAT Hidden in Fake MP4 Containers: PowerShell Loader + ISO-BMFF uuid Box Steganography — OTX Detection Pack
Active campaign hides encrypted NetSupport Manager RAT payloads inside fake MP4 files delivered via PowerShell loaders behind Cloudflare. High urgency — hunt now.
MovieReaper Torrent Supply-Chain Attack + Fake MP4 NetSupport RAT Loader: OTX Pulse Analysis — Enterprise Detection Pack
MovieReaper framework spreads via compromised torrents across 13 countries; separate campaign hides encrypted NetSupport RAT in fake MP4 files. High urgency — hunt now.
ClingSTUN Proxy Backdoor + Fake MP4 NetSupport Loader: OTX Pulse Analysis — Edge Device Hijacking & Encrypted RAT Delivery
OTX pulses reveal ClingSTUN converting exploited IoT edge devices into proxy botnet nodes, and fake MP4 containers smuggling encrypted NetSupport RAT payloads via PowerShell loaders.
BambooToken MQTT C2, PeckBirdy Scambling Infrastructure & Fake MP4 NetSupport RAT: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal MQTT-based BambooToken/PlugX campaign across Asia, 1.7M PeckBirdy casino-laundering domains, and fake MP4 files delivering encrypted NetSupport RAT. High urgency.
PEERSTITCH FortiGate Implant + Iron Man PhaaS Ecosystem: OTX Pulse Analysis — Edge Device & Phishing Detection Pack
CL-STA-0954 deploys PEERSTITCH memory-resident implant on FortiManager via CVE-2024-47575/CVE-2025-61624; Iron Man PhaaS kit mapped. Telecom, finance, gov at risk. Urgent patching + IOC sweep required.
Godzilla Webshell + SweetPotato/PrintSpoofer IIS Intrusion Set: OTX Pulse Detection Pack for Windows Web Servers
OTX pulse flags Q3 2026 attacks on IIS/Tomcat via CVE-2019-18935, webshells, WordPress scanning and Potato privilege escalation; hunt and patch now.
Noir Crypto Wallet Drainer Abuses DNS-over-HTTPS for C2: OTX Pulse Analysis — Enterprise Detection Pack
Noir, an AI-developed crypto wallet drainer, uses DNS TXT records and DoH as dynamic C2 via Cloudflare Pages. Web3 users targeted. Urgency: High.
JFrog Artifactory Zero-Day Chain (CVE-2026-42016 / CVE-2026-42018 / CVE-2026-82329): In-the-Wild Exploitation Drops Rust Backdoor via log.gitclone.org C2 — OTX Detection Pack
Active in-the-wild chaining of three critical JFrog Artifactory CVEs enables auth bypass, admin takeover, and Rust backdoor deployment via Groovy plugins. Patch and hunt now.
Mantax Otax Mobile Ransomware + NEBULA npm Supply-Chain RAT: OTX Pulse Analysis — Cross-Platform Detection Pack
OTX pulses expose Indonesian Android ransomware with Firebase C2 spyware and a 7-package npm supply-chain op dropping a Windows RAT. High urgency.
FRUITSHELL, PLOTSAFE, HOLLOWCLAD & MANTLEMAZE: AI-Analysis Evasion Malware Wave — OTX Detection Engineering Brief
OTX pulse flags 84 samples across FRUITSHELL, PLOTSAFE, HOLLOWCLAD & MANTLEMAZE using prompt-injection to evade AI triage. Enterprise detection pack inside.
Redis Rogue-Replication Miner, Hagaseca Android RAT Loader, DarkSword/Coruna iOS Exploit Platform: OTX Detection Pack
OTX: Redis rogue-replication miner, Hagaseca Android RAT and DarkSword/Coruna iOS exploit infra; block IOCs, hunt cron/ADB and wallet theft.
ClingSTUN Linux Back-Connect Proxy Abusing Public STUN: OTX Pulse Detection Pack for IoT and Edge Exploitation
OTX: ClingSTUN Linux back-connect proxy exploits IoT CVEs and abuses public STUN for egress mapping. Prioritize edge/IoT vuln closure and UDP 3478 hunts.
StyleSmuggler Zero-Day (CVE-2025-54236): Unauthenticated RCE Against Magento & Adobe Commerce — OTX Pulse Analysis & Detection Pack
Active exploitation of CVE-2025-54236, an unpatched Magento/Adobe Commerce 0-day enabling unauthenticated RCE via GraphQL style injection and payment email templates. Retail under attack.
XWorm RAT + DDGroup Botnet Infrastructure: OTX Pulse Analysis — Modular Malware Detection Pack
OTX pulse exposes DDGroup's XWorm RAT campaign: phishing delivery, ransomware staging, botnet C2 on 54 indicators. High urgency — hunt and block now.
Rogue ScreenConnect Worm-Like Propagation (XMRig) + SockTz AI-Enabled LATAM Campaign: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal worm-like rogue ScreenConnect/XMRig intrusions and AI-augmented SockTz campaigns targeting LATAM transportation, government, and finance. High urgency.
Microsoft Teams Help Desk Vishing Campaign: Fake IT Support Delivers Malware for Lateral Movement — OTX Detection Pack
OTX flags active campaign weaponizing Microsoft Teams help desk calls to trick users into installing malware. C2 domain and payload hash identified. Hunt now.
TIKTOUK WordPress Credential Harvesting Toolkit + Microsoft Teams Help Desk Social Engineering: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose TIKTOUK WordPress credential theft toolkit and Teams help-desk vishing campaigns targeting CMS configs and enterprise endpoints. High urgency.
Spring Ring Teams Vishing Campaign + Gryxa AI-Built RMM Toolkit: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose the Spring Ring Teams vishing operation (150+ users targeted) and Gryxa, an AI-assisted RMM/persistence toolkit. Hunt guidance, Sigma, KQL, IOC sweep.
RATHat Android Banking Trojan: From BlackCat Panel to Panda Workshop — ADB Exploitation C2 Detection Pack
RATHat Android banking trojan abuses wireless ADB debugging to deploy a native Go payload outside Android's permission model. Finance sector targeted. High urgency.
Blue Mockingbird Telerik CVE-2019-18935 Exploitation: Godzilla Web Shell + SweetPotato Privilege Escalation — OTX Detection Pack
Blue Mockingbird is exploiting unpatched Telerik UI (CVE-2019-18935) on IIS servers to drop Godzilla web shells and SweetPotato privesc tooling. US government targets. Patch and hunt now.
NetSupport Manager RAT Hidden in Fake MP4 uuid Boxes: PowerShell Loader Campaign — OTX Detection Pack
PowerShell loaders delivering encrypted NetSupport Manager RAT concealed inside fake MP4 ISO-BMFF uuid boxes via Cloudflare-fronted infrastructure. 64 IOCs. Hunt now.
AsyncAPI npm Supply-Chain Compromise: sync.js RAT via Lifecycle Hooks and IPFS Payload Delivery — OTX Detection Pack
Malicious AsyncAPI npm packages abused install hooks and IPFS delivery to stage a Node.js RAT through developer and CI/CD dependency chains. Hunt now.
OpenSUpdater SFX Evasion, Sliver C2 Against Philippine Nuclear/Defense, and SilentXMRMiner On-Endpoint Compilation: OTX Pulse Analysis — Enterprise Detection Pack
Three active campaigns: OpenSUpdater hidden in recompiled 7zip SFX, Chinese-speaking APT exfiltrating 9GB from Philippine nuclear/defense targets, and silent Monero miners compiled directly on endpoints. High urgency.
AvisLoader Windows Loader: Tox P2P C2 + ClickFix Social Engineering — OTX Detection & Hunting Pack
New AvisLoader malware uses Tox P2P encrypted C2 to survive takedowns. Delivered via ClickFix lures with UAC bypass and shortcut persistence. Hunt now.
Equation of Compromise: npm Supply-Chain Loader with Ethereum Smart Contract C2 — OTX Pulse Detection Pack
Sophisticated 6-month npm supply-chain campaign targets DeFi/quant developers via math libraries with encrypted loaders and Ethereum-based C2. Urgent hunt advised.
Brevo Supply Chain Compromise: WordPress Backdoor + ClickFix Dual-Payload Campaign — OTX Detection Pack
CRITICAL: Brevo CDN compromise poisoned 100k+ sites with WordPress backdoors and ClickFix overlays. IOCs, Sigma rules, KQL hunts, and response guidance inside.
ShadowHVNC RAT Kit + Brevo Supply-Chain ClickFix Campaign: OTX Pulse Analysis — Enterprise Detection Pack
Two active campaigns: ShadowHVNC/Shadow Loader RAT kit and a Brevo CDN supply-chain compromise pushing WordPress backdoors and ClickFix lures to 100k+ sites.
MovieReaper Torrent Loader, HEAVYGRAM Telegram Backdoor & Fake HTS Ransomware: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose MovieReaper torrent malware, Handala Hack's HEAVYGRAM Telegram backdoor, and fake HTS ransomware targeting finance. High urgency.
ValleyRAT via Signed Overwolf Sideloading + SilkParasite SpiceRAT C2 Cluster: OTX Pulse Analysis — Enterprise Detection Pack
ValleyRAT sideloaded via signed Overwolf binary targets Indian tax-themed phishing victims; SilkParasite SpiceRAT infrastructure hits government/energy across Central Asia. Hunt now.
Showing 50 of 195 reports. Archive expands automatically as new intel is generated.
Every Malware & Criminal Tooling Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.