Malware

The trojanized installer, identified as Kuailian_win-setup.86.msi, embeds a loader and an encrypted payload alongside the authentic LetsVPN application.

Armored Likho utilizes a modular and evolving toolkit that includes obfuscated remote access trojans (RATs), the Python-based BusySnake Stealer, and Go2Tunnel for network tunneling.

The campaign, detailed by Palo Alto Networks' Unit 42, begins with a phishing email containing a malicious PDF.

QuimaRAT features a modular architecture, allowing for dynamic expansion of capabilities through encrypted plugins delivered via its command-and-control (C2) infrastructure.

ChocoPoC operates by hiding its malicious payload within a Python package that is pulled in as a dependency by the seemingly harmless PoC code.

The attack chain begins with a single line of Python code executed via an unauthenticated Langflow API endpoint.

The "Google Notes" extension, identified by McAfee researchers, operates by requesting broad permissions, including access to all websites, browsing history, and the clipboard, which are unusual for a note-taking application.

The Ousaban campaign begins with a phishing PDF disguised as a corrupted file, prompting users to click an "Update" button.