Loading threat actor…
TA2727 is a financially motivated cybercriminal threat actor involved in web-inject malware distribution campaigns that abuse compromised legitimate websites and fake browser update lures. The cluster emerged as part of a broader ecosystem of copycat actors that expanded beyond TA569’s SocGholish operations beginning around 2023, and it has been tracked as a distinct actor since early 2025. TA2727 commonly relies on traffic supplied by TA2726, a malicious traffic distribution service operator that filters victims by geography and platform before redirecting them into TA2727-controlled delivery chains. TA2727 is known for distributing information-stealing malware across multiple operating systems. Reported payloads include Lumma Stealer and DeerStealer for Windows, Marcher for Android, and FrigidStealer for macOS. Its campaigns use fake browser or software update prompts presented on compromised websites, often tailored to the victim’s device type, browser, and geography. On Windows, observed chains have used MSI installers containing a legitimate signed application alongside a trojanized DLL to sideload a loader that ultimately deploys an infostealer. On macOS, TA2727 has used browser-themed disk images and social-engineering instructions designed to bypass Gatekeeper protections, then deployed FrigidStealer, a stealer that targets browser data, stored credentials, cryptocurrency-related files, and Apple Notes. Android users have been redirected from similar lures to banking-trojan payloads. The actor’s tradecraft centers on initial access through malicious web injects, selective victim routing through traffic distribution systems, defense evasion through use of legitimate websites and signed software components, and credential and data theft through follow-on infostealer payloads. TA2727 has also been associated with ClickFix-style delivery in macOS-focused chains. The actor operates within a collaborative cybercrime ecosystem in which compromised websites, redirect infrastructure, and malware delivery services are shared or resold among financially motivated groups, particularly alongside TA2726 and in parallel to TA569-style fake-update activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
11 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat cluster using TA2726 traffic to deliver payloads to macOS users, including FrigidStealer.
A copycat threat actor using fake-update style JavaScript injects and lures to distribute information-stealing malware.
Uses TA2726-delivered traffic in ClickFix-style attack chains targeting MacOS users and delivering FrigidStealer.
Threat actor distributing fake browser update lures to deliver information stealers across platforms (macOS/Windows/Android).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.