Malware

Attackers have been leveraging a DLL side-loading flaw in a binary linked with the open-source c-ares library to deploy various illicit payloads, including Agent Tesla, XWorm, DCRat, Remcos RAT, Vidar Stealer, Lumma Stealer, Formbook, and CryptBot, as part of an ongoing malware campaign, The Hacker News reports.

Virtual cybercrime subscription service stole $40 million in the U.S. alone.

Its capabilities include bank fraud, credential theft via JavaScript injection on legitimate banking pages, keylogging, ransomware attacks, and exploitation of Android's Accessibility Service.

The campaign is notable for its evasive techniques designed to complicate detection and analysis.

The malware was distributed through third-party app catalogs and suspicious websites, bypassing official app stores.

The campaign utilized a charity theme, with attackers sending instant messages via Signal or WhatsApp to lure targets to a fake charitable foundation website.

Discovered in December 2025, VoidLink is a modular framework featuring custom loaders, implants, and rootkits, written in the Zig programming language.

AVCheck, described as one of the world's largest counter-antivirus services, allowed cybercriminals to identify which antivirus products their malware could evade.