NetSupport RAT

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2 - Malware News - Malware Analysis, News and Indicators

Cisco Talos identified a months-long ClickFix cryptocurrency-theft campaign that tricks users into injecting malicious JavaScript into Chrome or installing it through Tampermonkey. Lures impersonate leaked reports of cryptocurrency-exchange API flaws and promise SwapZone or SimpleSwap trading bonuses. The scripts use Google Sheets and the Google Visualization API for command-and-control, hiding second-stage retrieval within trusted docs.google.com traffic, then replace cryptocurrency deposit addresses in webpages, intercepted responses, and the clipboard. Talos linked 49 Bitcoin wallets to the operation; 24 active wallets received 0.159 BTC, roughly $10,000 in early August 2026. ClickFix techniques continue to enable broader malware delivery as well as browser-based theft. A blocked July 2026 intrusion used phishing to induce in-memory PowerShell execution, followed by a loader, process injection into svchost.exe or explorer.exe, and deployment of PureLogs Stealer targeting browser credentials, cookies, banking data, and cryptocurrency wallets. Earlier activity tracked by Proofpoint showed ClearFake and TA571 using fake browser or certificate warnings and malicious clipboard content to persuade victims to manually run PowerShell, delivering stealers, RATs, loaders, and cryptominers. Organizations should treat unexpected browser verification prompts and copy-paste instructions as high-risk, while monitoring for browser script injection, anomalous Google-hosted script retrieval, and credential or wallet-address manipulation.

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Analyse technique de la campagne PureLogs Stealer 2026 : chaîne d'infection multi-stages | CyberVeille

Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON - IT Security Guru

A threat actor targeted security researchers after Black Hat and DEF CON by impersonating a senior CoinDesk-linked cryptocurrency media executive on X and sending conference-planning lures through trusted services including Google Docs, GitHub Releases, and Dropbox DocSend. Huntress reported that the first lure used a booby-trapped Google Doc with a malicious Google Apps Script sidebar that asked victims for an "encryption key," profiled the host, and then steered users into staged malware delivery paths tailored to macOS and Windows systems. On macOS, victims were served a disk image resembling Atomic macOS Stealer (AMOS), while Windows targets received a fake Google API Connector update that led to a ClickOnce application, PowerShell-based loaders, and additional payloads. Huntress said the Windows chain ultimately deployed NetSupport RAT, a fake Ledger wallet application, and a local TLS-intercepting proxy built around a rogue certificate authority, indicating goals that included credential theft, cryptocurrency wallet compromise, and persistent remote access; when the first attempt failed, the actor followed up with a second malicious document disguised as a DocSend share to continue the intrusion attempt.

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware | Huntress

GitHub - tjnel/certgraveyard_yara: Automated YARA rule generation from the Cert Central compromised certificate database. · GitHub

A public project called CertGraveyard has expanded efforts to document abused code-signing certificates used to sign malware, building a shared record of certificate abuse and helping defenders trigger revocations with certificate authorities. The project’s creator said the initiative grew out of years of reporting malicious certificates tied to malware such as SolarMarker, and has helped report more than 2,000 certificates, later growing to roughly 2,400 entries in the database. Supporting tooling includes certReport, which automates abuse reports from malware hashes using sources such as VirusTotal and MalwareBazaar, plus an API, downloadable datasets, feeds, hunting queries, and integrations with platforms including MalwareBazaar, UnpacMe, Malcat, MagicSword.io, and WDAC enforcement workflows. The database reflects a broader pattern in which threat actors repeatedly obtain or abuse valid Authenticode certificates to make malware appear trustworthy, reduce Windows warnings, and sustain delivery campaigns. Prior reporting cited SolarMarker cycling through impostor-issued certificates, FakeBat distributing signed MSI and MSIX installers, Netbounce using valid certificates and fake software branding, Dark Caracal signing Bandook variants with legitimate certificates, and Operation Red Signature abusing a stolen vendor certificate in a supply-chain intrusion. CertGraveyard’s operator said certificate authorities often act on external reports within hours, making revocation a practical disruption measure, though the project has also faced operational pressure including a major DDoS attack while handling heavy daily lookup and download volumes from defenders and malware-analysis integrations.

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft - Malware News - Malware Analysis, News and Indicators

Microsoft reported that social-engineering lures are increasingly being used to trick users into launching malware themselves, with the ClickFix technique emerging as a major delivery method across phishing, malvertising, and compromised websites. In ClickFix attacks, victims are shown fake CAPTCHA, verification, or repair prompts that copy malicious commands to the clipboard and persuade them to run them, often leading to fileless execution through LOLBins, obfuscated PowerShell, and follow-on payloads such as Lumma Stealer, DarkGate, Latrodectus, ScreenConnect, and AMOS. Microsoft said the technique has hit thousands of enterprise and consumer devices daily and is now supported by a growing underground market of ClickFix builder kits sold on criminal forums. Fresh activity shows the tactic continuing to evolve. A SmartApeSG campaign observed on compromised web traffic redirected victims to a fake human-verification flow that fetched an HTA downloader from deltaode[.]com, retrieved a ZIP archive, and abused DLL side-loading to launch an unidentified RAT that later communicated with 89.124.79[.]98 over TCP 443. Separately, Microsoft linked the CaptiveCrunch campaign to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard, which has manipulated DNS and HTTP traffic on hospitality and other captive-portal networks to redirect travelers to phishing pages and fake browser or OS updates delivering CornFlake and ChocoShell for credential theft and espionage, including theft of browser credentials, Microsoft 365 tokens, and Wi-Fi credentials.

Malware-Traffic-Analysis.net - 2026-07-31: SmartApeSG ClickFix campaign pushes unidentified RAT