Malware & Criminal Tooling Intelligence
New malware families, crimeware updates, loader/dropper campaigns, C2 infrastructure, and initial access broker tooling emerging from criminal underground channels.
Malware & Criminal Tooling — Archive & Latest
Project CAV3RN Espionage Framework: Google Apps Script C2 + DNS Channel Rotation Targeting Israel — OTX Detection Pack
Modular espionage framework CAV3RN targets Israeli entities using DNS A-record logic to rotate between HTTPS and Google Apps Script C2. High urgency for Israel-facing orgs.
SocGholish Dropcatch Scavengers + Project CAV3RN Google Apps Script C2: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal dropcatched domains feeding SocGholish/Keitaro fraud and CAV3RN espionage framework using Google Apps Script C2 against Israel. High urgency.
TencShell/Vshell AI-Assisted Intrusions + Project CAV3RN Google Apps Script C2: OTX Pulse Analysis — Enterprise Detection Pack
Two active campaigns exposed: AI-assisted intrusions hitting government networks across 4 nations, and CAV3RN espionage framework abusing Google Apps Script for stealth C2 in Israel. URGENT.
ShinyHunters OAuth Abuse + DarkHotel North Korea Lures + Jewelbug Antino Backdoor: OTX Pulse Analysis — Enterprise Detection Pack
OTX intel on ShinyHunters Salesforce OAuth vishing, DarkHotel MSI/shellcode phishing, and Jewelbug's Antino espionage backdoor. Defense, gov, SaaS targets. High urgency.
O&O Syspectr RAT Masquerading as CNN, Avast & Stremio Apps: Lookalike-Domain Social Engineering Campaign — OTX Pulse Analysis
Fake CNN, Avast, and Stremio sites push attacker-linked O&O Syspectr RMM installers. Windows users targeted. Block lookalike domains; hunt Syspectr installs now.
CNCMachineRMS RAT, Lazarus Operation Dream Job Zero-Day & APT-C-60 SpyGlace: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose a ClickFix-delivered CNCMachineRMS RAT, Lazarus zero-day job-lure attacks on defense/aerospace, and APT-C-60 SpyGlace campaigns hitting Japan. High urgency.
Project CAV3RN Espionage Framework: DNS-Driven C2 via Google Apps Script — OTX Pulse Detection Pack
Modular espionage framework Project CAV3RN targets Israeli entities using DNS A-record logic to pivot between HTTPS and Google Apps Script C2 relay channels.
Kimwolf v7 IoT Botnet + Project CAV3RN Espionage Framework: OTX Pulse Analysis — Blockchain C2 & Google Apps Script Detection Pack
OTX pulses reveal Kimwolf v7 botnet weaponizing Android TV boxes with Ethereum Name Service C2, and Project CAV3RN espionage framework abusing Google Apps Script against Israeli targets.
Multi-Stage PowerShell Loader Abusing Vercel Infrastructure: XOR/Base64 Obfuscation Chain Delivers Grape.exe & Trojanized draw.io — OTX Detection Pack
Active multi-stage PowerShell loader pulls ZIP payloads from Vercel hosting via dorenzaa.com; heavily obfuscated XOR/Base64 stages execute disguised binaries. Hunt now.
GigaWiper + Crucio-Derived Wiper Cluster: OTX Pulse Analysis — RabbitMQ C2 and Fake-Ransomware Destruction Detection Pack
OTX pulse: Golang GigaWiper backdoor fuses Crucio-derived wiping, fake ransomware and RabbitMQ C2; hunt hashes, AMQP, raw disk writes. High urgency.
ENDLESSDOORS Router Backdoor + Legion Loader TDS + MUSTANG PANDA ZOHOMURK: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal pre-installed IoT backdoors (ENDLESSDOORS), a 12,700-domain fake-CAPTCHA traffic distribution system, and MUSTANG PANDA espionage against India's government and energy sectors.
BINDCLOAK Modular Backdoor + MIXEDKEY Loader: OTX Pulse Analysis — Middle East Government Campaign Detection Pack
Multi-stage espionage campaign hits Middle East government & energy targets via BINDCLOAK backdoor, reflectively loaded by MIXEDKEY. Hunt C2 & IOCs now.
ScreenConnect RMM Abuse via WsgiDAV Staging & Cloudflare Tunnels: OTX Pulse Analysis — Enterprise Detection Pack
Active campaign abusing ScreenConnect RMM via phishing lures and Cloudflare tunnels. High urgency.
Phorpiex, Mozi, Mirai: Direct-to-IP C2 Tactics — OTX Pulse Analysis
OTX Alert: 45% of malware bypass DNS via Direct-to-IP. Phorpiex/Mozi active against Education/Gov. Immediate blocking required.
XCSSET v40 & SakDriver Rootkit: macOS Supply Chain & Windows Kernel Evasion
Active campaigns: XCSSET v40 targets macOS devs via Xcode; SakDriver kernel rootkit evades Windows defenses. High urgency.
The Crown Prince, Nezha: China Chopper, AntSword & Ghost RAT Web Shell Campaign
Active log poisoning campaign exploiting phpMyAdmin to deploy China Chopper, Nezha, and Ghost RAT. Global targets detected.
ValleyRAT Resurgence: SilverFox Fake Installer Campaigns & BYOVD Techniques
SilverFox actor targets Asia with ValleyRAT via fake installers, leveraging BYOVD and process injection to bypass defenses.
Supply Chain Attack: lib-mtop & aone-cli RAT Cluster — OTX Pulse Analysis
Typosquatting npm campaign delivering cross-platform RAT via lib-mtop and aone-cli targeting Alibaba developers. Critical supply chain risk.
GoGRPC Backdoor & Teams Vishing Campaign: Helpdesk Hijacker IAB Tactics — OTX Pulse Analysis
Active IAB campaign abusing Microsoft Teams vishing and Quick Assist to deploy GoGRPC backdoor. Critical urgency.
BabaDeda Loader + ClickFix Social Engineering: OTX Pulse Analysis — Enterprise Detection Pack
Advanced BabaDeda loader using ClickFix social engineering targeting enterprise networks. High urgency - widespread detection recommended.
AsyncRAT & Remcos RATs + BabaDeda Loader: Multi-Stage Phishing & ClickFix Campaigns — Enterprise Detection Pack
Active phishing campaigns delivering AsyncRAT/Remcos via steganography and the BabaDeda ClickFix loader. Urgent blocking required.
TonRAT, AsyncRAT & BabaDeda Campaigns: OTX Pulse Analysis — Enterprise Detection Pack
Active campaigns delivering TonRAT, AsyncRAT, and BabaDeda via ZIPs, phishing, and ClickFix. High urgency for hospitality.
wp2shell RCE Chain & CMSmap Webshell Deployment: OTX Pulse Analysis — Enterprise Detection Pack
Active exploitation of CVE-2026-63030/CVE-2026-60137 'wp2shell' chain drops CMSmap webshells on default WordPress installs. Urgent.
ZimReaper, wp2shell, and IOCONTROL: OTX Pulse Analysis — Critical Infrastructure Threat Pack
Active exploitation of Zimbra (CVE-2025-66376) by TA488, widespread wp2shell RCE on WordPress, and Cyber Av3ngers targeting US ICS via IOCONTROL.
TrickBot DNS Tunneling Variant: C2 Infrastructure & Persistence Analysis
Active TrickBot variant detected using DNS tunneling for C2. High urgency due to evasion techniques.
ValleyRAT & Lampion Campaigns: Multi-Vector VBS/HTML Threats Targeting Finance & Global WhatsApp Users
OTX pulses reveal active VBS-distributing WhatsApp campaign (ValleyRAT/gh0st RAT) and Portugal-targeted banking trojan (Lampion) via obfuscated HTML.
TELESHIM, MIXEDKEY, BINDCLOAK: Targeted Middle East Government Attack — OTX Pulse Analysis
Active East Asia-linked campaign uses TELESHIM (Telegram C2) and MIXEDKEY to target Middle East gov entities. High urgency.
Popa Android Proxyware SDK: Residential Proxy Network Abuse — OTX Pulse Analysis
Android proxyware 'Popa' and variants infect consumer devices via IPTV apps for commercial proxy networks. Urgent block required.
NetSupport RMM via Python Side-Loading: MediaFire ZIP Attack Chain Analysis
Urgent: Active NetSupport RMM campaign using MediaFire ZIPs, Python DLL side-loading, and dllhost.exe injection.
HelloNet APT & Daxin Rootkit Resurgence: OTX Pulse Analysis — Enterprise Detection Pack
Active APT campaigns HelloNet (Russia) and Daxin (Taiwan) exploit software updates and Winlogon via DLL sideloading. High urgency.
TencShell, Lucide Proxy & BadIIS: OTX Pulse Analysis — AI-Powered Intrusions & DDoS Botnets
Active AI-powered espionage (TencShell), npm-based DDoS bots (Lucide), and SQLi-to-crypto persistence (BadIIS) detected. High urgency.
Vercel-Hosted Phishing Campaign Distributing LogMeIn RAT: OTX Pulse Analysis
Cybercriminals abuse Vercel to deliver LogMeIn RAT via fake PDF viewers. High urgency.
RedHook RAT & Clubfoot Wolf OTX Pulse Analysis — Cloud Abuse & Remote Access Trojan Surge
Active RAT campaigns (RedHook, NetSupport, LogMeIn) targeting finance/manufacturing via phishing, Vercel abuse, and mobile ADB exploits. High urgency.
BabaDeda Loader: ClickFix Malware Campaign Analysis — Enterprise Detection Pack
Evolving BabaDeda loader using ClickFix technique for payload delivery. Urgent: block identified C2 IPs and hunt for installer-based infections.
Nezha Web Shell Campaign & BabaDeda ClickFix Loader: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal active abuse of Nezha monitoring tool via phpMyAdmin log poisoning and the evolution of the BabaDeda ClickFix loader.
AsyncRAT & Remcos Steganography Campaign: OTX Pulse Analysis — Enterprise Detection Pack
Active global phishing campaign using Excel macros and steganography to deliver AsyncRAT/Remcos. High urgency.
CastleRAT, AsyncRAT & Havoc Framework: Multi-Vector Malware Campaign Analysis — Detection Pack
Active campaigns utilizing ClickFix, steganography, and tax lures delivering CastleRAT, AsyncRAT, and Havoc. High urgency.
RustDuck Botnet, AsyncRAT Sideloading & Gamaredon GammaWorm: OTX Pulse Analysis — Enterprise Detection Pack
Critical surge in threats: RustDuck IoT DDoS botnet, AsyncRAT via typosquatting, and Gamaredon espionage targeting Ukraine.
Gamaredon APT, BTMOB Android RAT & Malicious VPN Extensions: OTX Pulse Analysis
FSB-linked Gamaredon targeting Ukraine, Android RAT surge in LatAm, and clipper malware distributed via trojanized VPN extensions.
GHOST STADIUM, Millenium RAT, and LokiBot: OTX Pulse Analysis — Phishing, MaaS, and Infostealer Campaigns
Active campaigns detected: FIFA World Cup phishing (Vidar/Lumma), Millenium RAT MaaS, and LokiBot infostealer. High urgency for credential protection.
FortiBleed Harvesters & Ghost Stadium Phish: OTX Pulse Analysis — Steganography & Credential Theft
Three active threats: FortiBleed FortiGate harvester, multi-stage stego loaders (Remcos/Agent Tesla), and Ghost Stadium FIFA fraud.
StrikeShark Campaign & macOS.Gaslight Backdoor: OTX Pulse Analysis — Multi-Vector Threat Briefing
Active StrikeShark exploitation, DPRK macOS.Gaslight backdoor, and PostCSS supply chain RAT detected. High urgency for gov/tech sectors.
Lazarus Supply Chain & Cloud Atlas APT: OTX Pulse Analysis — Multi-Vector Malware Detection Pack
Urgent: Lazarus 3CX supply chain attack and Cloud Atlas APT campaigns targeting Gov/Healthcare. IOCs and detection rules inside.
Lazarus Supply Chain & Cloud Atlas RATs: OTX Pulse Analysis — Global Threat Briefing
Lazarus targets finance/energy via trojanized 3CX; Cloud Atlas and unknown actors hit gov/healthcare with stealers and RATs. Urgency: High.
Shai-Hulud npm Worm, Cloud Atlas APT, & Gentlemen RaaS: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal active supply-chain attacks via npm, Cloud Atlas APT targeting government, and Gentlemen ransomware defense evasion tactics.
Shai-Hulud Supply Chain Attack, Cloud Atlas APT Recon, and The Gentlemen RaaS Evasion: OTX Pulse Analysis
Critical threats: Shai-Hulud npm worm, Cloud Atlas phishing new payloads, and The Gentlemen ransomware clearing logs.
Shai-Hulud NPM Worm, The Gentlemen RaaS, & ClickFix Polymorphism: OTX Pulse Analysis
Active npm supply-chain attacks, evasive ransomware TTPs, and polymorphic ClickFix campaigns detected. High urgency for credential theft.
Operation Endgame Aftermath: SocGholish, NPM Shai-Hulud Worm, and ClickFix Fileless Attacks
Briefing on SocGholish infrastructure disruption, npm Shai-Hulud worms, and ClickFix fileless attacks. Critical detection guidance included.
Operation Endgame Disruption & Shai-Hulud Supply Chain: TA569, GoldFactory, and NPM Threats
TA569 infrastructure disrupted; Shai-Hulud worm hits npm; GoldFactory tax fraud active. Block IOCs immediately.
Shai-Hulud, ShinyHunters (CVE-2026-35273), & Potemkin Loader: OTX Pulse Analysis — Enterprise Detection Pack
Active NPM supply chain attack, Oracle PeopleSoft zero-day exploitation, and Potemkin ClickFix loader campaign detected. High urgency.
Showing 50 of 117 reports. Archive expands automatically as new intel is generated.
Every Malware & Criminal ToolingReport Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.