Malware & Criminal Tooling Intelligence
New malware families, crimeware updates, loader/dropper campaigns, C2 infrastructure, and initial access broker tooling emerging from criminal underground channels.
Malware & Criminal Tooling — Archive & Latest
BambooToken MQTT C2, PeckBirdy Scambling Infrastructure & Fake MP4 NetSupport RAT: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal MQTT-based BambooToken/PlugX campaign across Asia, 1.7M PeckBirdy casino-laundering domains, and fake MP4 files delivering encrypted NetSupport RAT. High urgency.
PEERSTITCH FortiGate Implant + Iron Man PhaaS Ecosystem: OTX Pulse Analysis — Edge Device & Phishing Detection Pack
CL-STA-0954 deploys PEERSTITCH memory-resident implant on FortiManager via CVE-2024-47575/CVE-2025-61624; Iron Man PhaaS kit mapped. Telecom, finance, gov at risk. Urgent patching + IOC sweep required.
Godzilla Webshell + SweetPotato/PrintSpoofer IIS Intrusion Set: OTX Pulse Detection Pack for Windows Web Servers
OTX pulse flags Q3 2026 attacks on IIS/Tomcat via CVE-2019-18935, webshells, WordPress scanning and Potato privilege escalation; hunt and patch now.
Noir Crypto Wallet Drainer Abuses DNS-over-HTTPS for C2: OTX Pulse Analysis — Enterprise Detection Pack
Noir, an AI-developed crypto wallet drainer, uses DNS TXT records and DoH as dynamic C2 via Cloudflare Pages. Web3 users targeted. Urgency: High.
JFrog Artifactory Zero-Day Chain (CVE-2026-42016 / CVE-2026-42018 / CVE-2026-82329): In-the-Wild Exploitation Drops Rust Backdoor via log.gitclone.org C2 — OTX Detection Pack
Active in-the-wild chaining of three critical JFrog Artifactory CVEs enables auth bypass, admin takeover, and Rust backdoor deployment via Groovy plugins. Patch and hunt now.
Mantax Otax Mobile Ransomware + NEBULA npm Supply-Chain RAT: OTX Pulse Analysis — Cross-Platform Detection Pack
OTX pulses expose Indonesian Android ransomware with Firebase C2 spyware and a 7-package npm supply-chain op dropping a Windows RAT. High urgency.
FRUITSHELL, PLOTSAFE, HOLLOWCLAD & MANTLEMAZE: AI-Analysis Evasion Malware Wave — OTX Detection Engineering Brief
OTX pulse flags 84 samples across FRUITSHELL, PLOTSAFE, HOLLOWCLAD & MANTLEMAZE using prompt-injection to evade AI triage. Enterprise detection pack inside.
Redis Rogue-Replication Miner, Hagaseca Android RAT Loader, DarkSword/Coruna iOS Exploit Platform: OTX Detection Pack
OTX: Redis rogue-replication miner, Hagaseca Android RAT and DarkSword/Coruna iOS exploit infra; block IOCs, hunt cron/ADB and wallet theft.
ClingSTUN Linux Back-Connect Proxy Abusing Public STUN: OTX Pulse Detection Pack for IoT and Edge Exploitation
OTX: ClingSTUN Linux back-connect proxy exploits IoT CVEs and abuses public STUN for egress mapping. Prioritize edge/IoT vuln closure and UDP 3478 hunts.
StyleSmuggler Zero-Day (CVE-2025-54236): Unauthenticated RCE Against Magento & Adobe Commerce — OTX Pulse Analysis & Detection Pack
Active exploitation of CVE-2025-54236, an unpatched Magento/Adobe Commerce 0-day enabling unauthenticated RCE via GraphQL style injection and payment email templates. Retail under attack.
XWorm RAT + DDGroup Botnet Infrastructure: OTX Pulse Analysis — Modular Malware Detection Pack
OTX pulse exposes DDGroup's XWorm RAT campaign: phishing delivery, ransomware staging, botnet C2 on 54 indicators. High urgency — hunt and block now.
Rogue ScreenConnect Worm-Like Propagation (XMRig) + SockTz AI-Enabled LATAM Campaign: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal worm-like rogue ScreenConnect/XMRig intrusions and AI-augmented SockTz campaigns targeting LATAM transportation, government, and finance. High urgency.
Microsoft Teams Help Desk Vishing Campaign: Fake IT Support Delivers Malware for Lateral Movement — OTX Detection Pack
OTX flags active campaign weaponizing Microsoft Teams help desk calls to trick users into installing malware. C2 domain and payload hash identified. Hunt now.
TIKTOUK WordPress Credential Harvesting Toolkit + Microsoft Teams Help Desk Social Engineering: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose TIKTOUK WordPress credential theft toolkit and Teams help-desk vishing campaigns targeting CMS configs and enterprise endpoints. High urgency.
Spring Ring Teams Vishing Campaign + Gryxa AI-Built RMM Toolkit: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose the Spring Ring Teams vishing operation (150+ users targeted) and Gryxa, an AI-assisted RMM/persistence toolkit. Hunt guidance, Sigma, KQL, IOC sweep.
RATHat Android Banking Trojan: From BlackCat Panel to Panda Workshop — ADB Exploitation C2 Detection Pack
RATHat Android banking trojan abuses wireless ADB debugging to deploy a native Go payload outside Android's permission model. Finance sector targeted. High urgency.
Blue Mockingbird Telerik CVE-2019-18935 Exploitation: Godzilla Web Shell + SweetPotato Privilege Escalation — OTX Detection Pack
Blue Mockingbird is exploiting unpatched Telerik UI (CVE-2019-18935) on IIS servers to drop Godzilla web shells and SweetPotato privesc tooling. US government targets. Patch and hunt now.
NetSupport Manager RAT Hidden in Fake MP4 uuid Boxes: PowerShell Loader Campaign — OTX Detection Pack
PowerShell loaders delivering encrypted NetSupport Manager RAT concealed inside fake MP4 ISO-BMFF uuid boxes via Cloudflare-fronted infrastructure. 64 IOCs. Hunt now.
AsyncAPI npm Supply-Chain Compromise: sync.js RAT via Lifecycle Hooks and IPFS Payload Delivery — OTX Detection Pack
Malicious AsyncAPI npm packages abused install hooks and IPFS delivery to stage a Node.js RAT through developer and CI/CD dependency chains. Hunt now.
OpenSUpdater SFX Evasion, Sliver C2 Against Philippine Nuclear/Defense, and SilentXMRMiner On-Endpoint Compilation: OTX Pulse Analysis — Enterprise Detection Pack
Three active campaigns: OpenSUpdater hidden in recompiled 7zip SFX, Chinese-speaking APT exfiltrating 9GB from Philippine nuclear/defense targets, and silent Monero miners compiled directly on endpoints. High urgency.
AvisLoader Windows Loader: Tox P2P C2 + ClickFix Social Engineering — OTX Detection & Hunting Pack
New AvisLoader malware uses Tox P2P encrypted C2 to survive takedowns. Delivered via ClickFix lures with UAC bypass and shortcut persistence. Hunt now.
Equation of Compromise: npm Supply-Chain Loader with Ethereum Smart Contract C2 — OTX Pulse Detection Pack
Sophisticated 6-month npm supply-chain campaign targets DeFi/quant developers via math libraries with encrypted loaders and Ethereum-based C2. Urgent hunt advised.
Brevo Supply Chain Compromise: WordPress Backdoor + ClickFix Dual-Payload Campaign — OTX Detection Pack
CRITICAL: Brevo CDN compromise poisoned 100k+ sites with WordPress backdoors and ClickFix overlays. IOCs, Sigma rules, KQL hunts, and response guidance inside.
ShadowHVNC RAT Kit + Brevo Supply-Chain ClickFix Campaign: OTX Pulse Analysis — Enterprise Detection Pack
Two active campaigns: ShadowHVNC/Shadow Loader RAT kit and a Brevo CDN supply-chain compromise pushing WordPress backdoors and ClickFix lures to 100k+ sites.
MovieReaper Torrent Loader, HEAVYGRAM Telegram Backdoor & Fake HTS Ransomware: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose MovieReaper torrent malware, Handala Hack's HEAVYGRAM Telegram backdoor, and fake HTS ransomware targeting finance. High urgency.
ValleyRAT via Signed Overwolf Sideloading + SilkParasite SpiceRAT C2 Cluster: OTX Pulse Analysis — Enterprise Detection Pack
ValleyRAT sideloaded via signed Overwolf binary targets Indian tax-themed phishing victims; SilkParasite SpiceRAT infrastructure hits government/energy across Central Asia. Hunt now.
Mythic C2 Infrastructure Exposure + Operation QUICSILVER (QUICAgent): OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose 131 Mythic C2 servers and Operation QUICSILVER, a China-nexus campaign hitting Myanmar diplomats with VHD-delivered Go backdoors. Hunt now.
C2Looper Rust Backdoor, Exposed Mythic C2 Fleet & Operation QUICSILVER: OTX Pulse Detection Pack — GitHub C2 Abuse, ClickFix Chains & QUIC Backdoors
OTX pulse analysis: Rust-based C2Looper backdoor abusing GitHub C2, 131 exposed Mythic C2 servers, and China-nexus Operation QUICSILVER targeting Myanmar diplomats. High urgency.
PIVOTPIPE .NET Beacon & Mythic C2 Infrastructure at Scale: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal PIVOTPIPE, a new .NET Cobalt Strike-style beacon, plus 131 internet-exposed Mythic C2 servers. Block IOCs and hunt for beaconing now.
JFrog Artifactory CVE-2026-42016/42018/82329 Exploit Chain + Rust Backdoor: OTX Detection Pack
Active in-the-wild chaining of three JFrog Artifactory CVEs for auth bypass, admin compromise, Groovy plugin abuse and Rust backdoor deployment. Patch and hunt now.
Project CAV3RN Google Apps Script C2 Framework + JFrog Artifactory CVE-2026-42016/42018/82329 Exploitation: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose Project CAV3RN espionage framework using DNS-selected Google Apps Script C2 against Israeli targets, plus active in-the-wild JFrog Artifactory CVE chaining. Hunt now.
Kimwolf v7 IoT Botnet, CAV3RN Espionage Framework & Malicious Crypto Extensions: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose Kimwolf v7 IoT DDoS botnet with blockchain C2, CAV3RN espionage framework targeting Israel, and browser extensions stealing crypto trader sessions. Act now.
WindRelay NFC Fraud Combo, SloppyRAT ClickFix Chains & Head Mare TrueConf Zero-Day: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal NFC-relay banking fraud (WindRelay/SpyNote), ransomware-stage SloppyRAT via ClickFix, and Head Mare APT exploiting TrueConf servers. High urgency.
Mantax Otax Mobile Ransomware, CAV3RN Espionage Framework & Browser Extension Crypto Theft: OTX Pulse Detection Pack
OTX pulses reveal Indonesian mobile ransomware-spyware, a Google Apps Script C2 espionage framework hitting Israel, and malicious browser extensions stealing crypto sessions. High urgency.
Redis Cryptomining Botnet (3,562 Compromised Servers) + Hagaseca Android RAT Loader: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses expose a rogue-replication Redis botnet mining Monero across 3,562 servers and Hagaseca, a packed Android RAT spreading via exposed ADB. Hunt now.
StyleSmuggler 0-Day (CVE-2025-54236): Unauthenticated RCE Campaign Against Magento & Adobe Commerce — OTX Pulse Analysis + Detection Pack
Actively exploited zero-day in Magento/Adobe Commerce enables unauthenticated RCE via style property injection and payment email templates. IOCs, Sigma, KQL, and hunt scripts inside.
FDMTP Implant via QuickFox Supply Chain Attack + ENDLESSDOORS Router Backdoor (CVE-2026-66747): OTX Detection Pack
Two supply chain campaigns exposed: trojanized QuickFox VPN installers deploying the FDMTP implant, and Zbtlink routers shipping with the pre-installed ENDLESSDOORS backdoor (CVE-2026-66747).
Microsoft Teams Help-Desk Vishing + RMM Lateral Movement: OTX Pulse Detection Pack
OTX flags Teams help-desk impersonation leading to malware execution and lateral movement; 8 IPv4 C2/RMM indicators. Enterprise SOC urgency: high.
ScreenConnect RMM Abuse + SockTz AI-Enabled Intrusions + Teams Help Desk Vishing: OTX Pulse Analysis — Enterprise Detection Pack
Multi-wave campaigns abuse ScreenConnect RMM, Cloudflare tunnels, AI tooling, and Teams vishing against LATAM and enterprise orgs. Detection pack included. Hunt immediately.
D2IP C2 Evasion + Rogue ScreenConnect Worm Activity + Teams Help Desk Social Engineering: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal 45% of malware bypassing DNS via direct-to-IP C2, worm-like rogue ScreenConnect RMM deployments dropping XMRig, and Teams help desk vishing. High urgency for education, government, and transportation sectors.
XCSSET v40 Supply Chain Surge + SakDriver Kernel Rootkit + Teams Help Desk Intrusion: OTX Detection Pack
OTX pulses reveal XCSSET v40 infecting Xcode dev environments, the SakDriver Ring-0 rootkit evading ETW, and Teams-based help desk intrusion with live C2. High urgency — hunt now.
EtherHiding Magecart Campaign: Blockchain-Staged Card Skimmers Targeting WooCommerce & Magento — OTX Detection Pack
OTX pulse reveals Magecart operators staging payment skimmers inside Ethereum smart contracts, compromising WooCommerce, PrestaShop and Magento storefronts. High urgency for retail/e-commerce defenders.
Spring Ring Teams Vishing + EtherHiding Magecart + Gryxa AI-Built Toolkit: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal Teams-based vishing (Spring Ring), blockchain-staged Magecart skimmers, and the AI-built Gryxa RMM toolkit. Retail & enterprise targets. High urgency.
Fake MP4 ISO-BMFF Trojan + NetSupport RAT: PowerShell Loader Campaign via Cloudflare Infrastructure — OTX Detection Pack
Active campaign hides encrypted NetSupport Manager RAT inside fake MP4 uuid boxes, delivered via Cloudflare-fronted PowerShell loaders. High urgency — deploy IOCs & hunts now.
ToxicPanda + BadBox OTX Pulse: AI-Guardrail Safety Penalties, Android Banking Fraud, and Botnet Detection Pack
OTX pulse links ToxicPanda/BadBox indicators to AI-guardrail failure risks in SOC workflows; education and finance face elevated fraud and botnet exposure.
AsyncAPI npm Supply Chain RAT, VShell/SNOWLIGHT Go Loader & AnonyMousKIT AI PhaaS: OTX Pulse Analysis — Enterprise Detection Pack
Three active campaigns: AsyncAPI npm supply chain RAT, VShell/SNOWLIGHT targeting China defense-tech, and AnonyMousKIT AI PhaaS across 506 domains. Immediate action required.
GoGRPC Backdoor + Teams Vishing IAB Campaign and Sliver Intrusions on Philippine Nuclear/Defense Targets: OTX Pulse Analysis — Enterprise Detection Pack
OTX pulses reveal a Teams vishing IAB deploying GoGRPC/BlindDoor backdoors and a suspected Chinese-speaking operator hitting Philippine nuclear and naval targets. Act now.
RMM Phishing Campaign (Fake CRA T4 / SSA Lures): Living-Off-the-Land RMM Abuse — OTX Pulse Detection Pack
Phishing operation impersonating CRA, SSA & Adobe delivers legitimate RMM tooling via password-protected archives; 46 countries hit, 45% US. Hunt now.
wp2shell Pre-Auth RCE Chain (CVE-2026-63030 / CVE-2026-60137) Targeting WordPress Core: OTX Pulse Analysis — Enterprise Detection Pack
CRITICAL: Unauthenticated RCE chain 'wp2shell' in WordPress Core is under active mass exploitation. Webshells, SQLi, and batch API abuse observed. Patch and hunt now.
Grandoreiro DLL Sideloading Campaign + PRIVATELOADER Residential Proxy SDK: OTX Pulse Analysis — Enterprise Detection Pack
Grandoreiro banking trojan hits Mexico/Spain via DLL sideloading; PRIVATELOADER spreads Peer2Profit proxy SDK. 59 IOCs live. High urgency for finance.
Showing 50 of 171 reports. Archive expands automatically as new intel is generated.
Every Malware & Criminal Tooling Report Includes SIGMA & KQL Detection Rules
Every intelligence briefing on this page includes at least one Sigma rule, a Microsoft Sentinel KQL hunt query, and an IOC check script — ready to drop into your SIEM. No paywall. No registration.