Loading story…
Researchers reported a malware campaign that abuses the legitimate Windows Error Reporting binary WerFault.exe to stealthily deploy Pupy RAT through DLL sideloading. The infection chain begins with a phishing email carrying an ISO attachment that contains WerFault.exe, a malicious faultrep.dll, a decoy XLS file, and a shortcut file that launches the payload via scriptrunner.exe and cmd. Because WerFault.exe is a Microsoft-signed binary, the technique helps the malware blend in with normal system activity and reduce suspicion from security tools.
Analysis showed the malicious DLL uses a custom API resolver, spawns threads to open the lure spreadsheet, decrypts an embedded overlay with RC4 using SystemFunction032, and loads the decrypted PE directly into memory as Pupy RAT. The RAT was observed attempting to reach a command-and-control server at 103.79.76.40, although the server was offline during examination. Researchers said attribution remains unconfirmed, but the Chinese-language lure and other indicators suggest the operators may be China-based or targeting victims in China; the use of Pupy RAT also raises concern because the open-source remote access trojan has previously been linked to espionage activity and enables full device compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
K7 Security Labs analyzed a malware campaign in which attackers used a phishing-delivered ISO to abuse the legitimate Windows Error Reporting binary WerFault.exe, sideload a malicious faultrep.dll, and execute Pupy RAT in memory. The researchers assessed that the lure content suggested likely targeting in China, though attribution to a specific actor was not confirmed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Researchers at Point Wild reported a malware campaign that abuses the legitimate packaging tool **PyInstaller** to disguise and deliver **XWorm RAT v7.4** inside files presented as benign software or updates. The infection chain uses obfuscation and anti-analysis techniques, including a routine identified as `_IAT_PHANTOM_FIX`, then patches **AMSI** in memory to weaken Windows scanning before unpacking an encrypted payload. The malware is then dropped into `%LOCALAPPDATA%` as the hidden system file `Win.Kernel_Svc_AJ8iOw.exe`, helping it evade user notice and endpoint defenses. Once installed, the payload connects to command-and-control infrastructure at `68.219.64.89:4444` using an **AES** key and enables a broad set of remote-access capabilities. Point Wild said XWorm can steal passwords, access files, activate webcams, launch **DDoS** attacks, and provide full remote control; researchers also observed deployment of an additional file, `afacan313131.exe`, as part of the intrusion. The findings show how attackers are combining trusted developer tools with memory patching and encrypted payload delivery to make a well-known malware family harder to detect.
Jun 29, 2026
Multiple active malware campaigns are using **social engineering** and **trojanized content** to compromise Windows systems, with lures ranging from pirated software downloads to business and shipping documents. AhnLab reported a “proxyjacking” operation attributed to **Larva-25012** that distributes fake installers (notably a trojanized *Notepad++* package) via cracked-software sites; the `Setup.zip` bundle includes a legitimate `Setup.exe` plus a malicious sideloaded DLL (`TextShaping.dll`) that decrypts and installs **DPLoader** for persistent command retrieval and follow-on payload delivery. The malware also tampers with defenses by changing Microsoft Defender settings (e.g., exclusions, reduced notifications, and blocking sample submission) to reduce detection while monetizing victims’ bandwidth through installed **proxyware**. Separately, FortiGuard Labs described a Russia-focused, multi-stage intrusion chain that abuses trusted services (**GitHub** and **Dropbox**) for payload hosting and weaponizes **Defendnot** (a Windows Security Center trust-model research tool) to disable **Microsoft Defender** before deploying a ransomware payload. Fortinet also documented phishing campaigns using weaponized shipping-themed Word documents to deliver **Remcos RAT**, including fileless execution behavior and exploitation of `CVE-2017-11882` (Microsoft Equation Editor) via remotely fetched templates. These campaigns reinforce the operational risk from user-driven execution paths (pirated installers and document lures), “living off the land” techniques, and defense evasion through both policy tampering and security tooling abuse.
Jun 29, 2026