Loading story…
Researchers detailed the CrackedCantil campaign, in which victims searching for cracked software were funneled through Google Groups results and password-protected archives into a coordinated multi-stage malware infection chain. The operation used PrivateLoader as a central distributor and tasking mechanism, with additional malware including SmokeLoader, Lumma, RedLine, RisePro, Amadey, StealC, Vidar, Socks5systemz, a coinminer, and STOP ransomware. Reported behaviors included PowerShell execution, credential theft, keylogging, browser-data collection, screenshots, system discovery, persistence, and defense evasion.
The infection chain was designed to maximize theft and system abuse before file encryption, with environment-aware payload delivery, randomized filenames, and encrypted or Base64-encoded command-and-control traffic helping the malware evade detection. Infostealers harvested credentials and host data, proxyware and mining components monetized compromised machines, and STOP ransomware later encrypted files, persisted across reboot, and in some cases appended extensions such as .hhaz. Researchers said the campaign reflects a deliberately coordinated ecosystem focused on data theft, resource hijacking, and destructive impact rather than a single standalone malware payload.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The CrackedCantil campaign was active mainly between late 2023 and early 2024, using cracked software lures surfaced through Google Groups search results and password-protected archives to infect victims.
Researchers analyzed the CrackedCantil case as a coordinated multi-malware infection chain centered on cracked software, with PrivateLoader orchestrating delivery of multiple malware families including SmokeLoader, Lumma, RedLine, StealC, Amadey, and STOP ransomware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026
Microsoft, Europol, law enforcement agencies, and multiple private-sector partners carried out a coordinated disruption of the **StealC** infostealer and **Amadey** loader ecosystems, using court orders and related legal actions to target both malware operations at once. The operation struck a broad criminal infrastructure spanning more than 200 command-and-control domains and IP addresses, with partner reporting citing **66 domains** and **296 servers** tied to the two services. Microsoft said the malware families were linked to more than **140,000 infected computers** in a single week in May, while partner investigators reported the seizure of **25.6 million unique credentials** stolen from more than **385,000 compromised systems**. Investigators said **StealC**, active since 2023 as a malware-as-a-service infostealer, was used to steal browser data, credentials, email and messaging data, VPN and cloud access, and cryptocurrency wallet information, while **Amadey**, active since 2018, functioned as a modular loader and backdoor that frequently delivered StealC and other payloads. Researchers also identified a vulnerability in the StealC command-and-control panel that helped support search-and-seizure actions, and they used configuration extraction and a custom emulator to map affiliate activity and delivery chains. The two malware families were described as part of a broader cybercrime ecosystem tied to credential theft, access brokering, and downstream attacks including ransomware, with observed links to payloads such as **AsyncRAT**, **RedLine**, **Vidar**, **XMRig**, and in one case **LockBit Black**.
Aug 11, 2026
Researchers reported multiple financially motivated malware campaigns using **SmokeLoader** as a delivery mechanism for follow-on payloads including **Gozi ISFB**, **ZLoader**, **Oski**, **AveMaria**, **Cobalt Strike**, **SystemBC**, **RecordBreaker**, and the **Laplas Clipper** cryptocurrency hijacker. In one campaign set, attackers abused website contact forms and sent phishing lures posing as copyright complaints, directing victims to malicious documents hosted on legitimate services such as **Google Drive**. Talos found the initial payloads were wrapped in a shared crypter identified by the DOS-stub string **"Salfram,"** indicating a common tooling layer across otherwise varied malware deliveries. The activity relied on evasive and modular infection chains designed to complicate detection and maximize monetization. The **Salfram** crypter used obfuscation methods including fake API calls, fragmented control flow, self-modifying code, and memory allocation through `ZwAllocateVirtualMemory`, while later-stage malware added persistence and theft capabilities. Cyble said **Laplas Clipper** monitored the clipboard for cryptocurrency wallet addresses, pulled regex patterns and replacement addresses from `clipper[.]guru`, and persisted by copying itself into `%appdata%` and creating a scheduled task that ran every minute. The combined use of phishing, legitimate hosting platforms, crypter-based obfuscation, and multi-payload delivery shows an adaptable criminal ecosystem built to steal credentials, proxy access, banking data, and cryptocurrency funds.
Aug 15, 2026