Storm-3075

Storm-3075 is a threat actor tracked by Microsoft as an initial access broker and malware distributor. Microsoft attributes AI-themed malvertising activity to this actor and assesses that it delivers final payloads on behalf of multiple downstream actors. Observed lures included fake software such as "Awesome AI Windows Plugin" and "Flux Pro AI," promoted through malvertising and free movie streaming sites. In one campaign on March 13, 2026, Microsoft reported that a single Storm-3075 operation targeted more than 66,000 devices, with most impacted devices likely being consumer endpoints; the top affected countries were Japan, South Africa, the United States, and France. In the documented infection chain, users were redirected to download a fraudulently code-signed executable, ProFluxeFlowAi-win-Setup.exe, from GitHub. The malware used a CAPTCHA-like or "Continue" interaction step to delay execution and help evade sandbox or automated analysis, then dropped pythonw.exe and a downloader script into \AppData\Local, retrieved next-stage malware from brokeapt[.]com, and ultimately delivered Vidar stealer. Microsoft also reported Storm-3075 distributing Lumma Stealer, Hijack Loader, and Oyster in related campaigns. The malware-signing activity in these campaigns was linked by Microsoft to Fox Tempest, a financially motivated actor operating a malware-signing-as-a-service offering. No aliases or sub-groups beyond Storm-3075 are directly provided in the content.