RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs, and MFA Codes

Key facts for RatHat Android AI banker

Detection coverage for RatHat Android AI banker

As of 2026-09-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2592 across Splunk SPL, Microsoft KQL and Sigma, covering 65 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RatHat — C2 Beaconing to Published Domains and FRP Reverse-Tunnel / Loopback Command Channel

Detects network-layer C2 activity: DNS/proxy contact with any of Zimperium's 16 published RatHat C2 domains (HTTPS admin/config: fegrs.adidasabc.com, admin.xiongmaocs.help, blackcat880.shop, cheng770.cyou; WSS command channel: admin.xiongmaocs.mom, admin.niaotong2.top, heilongyk.top, cz.gpgmk.com) hitting the documented endpoint set (/api/node/register, /api/data/credentials, /api/data/messages, /api/data/cipher, /api/tun/config, /api/v2/dev/tasks, /api/v2/dev/localServiceHeartbeat, /api/v2/dev/upload/video), combined with an on-device loopback listener on 127.0.0.1:7910 (liblocal-service.so) and an outbound persistent WSS/HTTPS reverse-tunnel matching the fatedier/frp client fingerprint (libmedia_codec.so) — the C2/lateral-movement/proxy stage that carries stolen credentials, SMS/OTP content, and reconstructed lock-screen material off the device.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1437, T1604, T1517, T1636.004, T1513, T1461, T1417.002, T1533, T1418
• Data sources: DNS query logs, web/HTTP(S) proxy logs, firewall/egress flow logs, on-device netstat/loopback-listener telemetry (MTD/EDR)
• Severity: critical
• Confidence: high

Splunk SPL

(index=dns OR index=proxy OR index=firewall)
  (dest_host="fegrs.adidasabc.com" OR dest_host="admin.xiongmaocs.help" OR dest_host="blackcat880.shop" OR dest_host="cheng770.cyou" OR dest_host="oop.uuokxx.com" OR dest_host="andxxxo.com" OR dest_host="admin.xiongmaocs.mom" OR dest_host="admin.xiongmaocs.pics" OR dest_host="admin.fjbjwgyuyftg.qpon" OR dest_host="admin.niaotong2.top" OR dest_host="heilongyk.top" OR dest_host="cz.gpgmk.com" OR dest_host="cunzhang.krgdef.cn" OR dest_host="bc.etlva.cn" OR dest_host="jiaozhu.etlva.cn" OR dest_host="mao.terh5.cn")
| eval uri_path=coalesce(uri_path,http_uri)
| eval c2_endpoint=case(
    like(uri_path,"%/api/node/register%"),"register",
    like(uri_path,"%/api/data/credentials%"),"credentials_exfil",
    like(uri_path,"%/api/data/messages%"),"sms_exfil",
    like(uri_path,"%/api/data/cipher%"),"lockscreen_exfil",
    like(uri_path,"%/api/tun/config%"),"tunnel_config",
    like(uri_path,"%/api/v2/dev/tasks%"),"task_poll",
    like(uri_path,"%/api/v2/dev/localServiceHeartbeat%"),"heartbeat",
    like(uri_path,"%/api/v2/dev/upload/video%"),"screen_video_exfil",
    1=1,"other")
| join type=left src_host
  [ search index=mtd OR index=edr sourcetype="android:netstat" local_addr="127.0.0.1" local_port=7910
  | eval loopback_hit=1 ]
| table _time src_host dest_host uri_path c2_endpoint loopback_hit
| sort -_time

Microsoft KQL

let RatHatC2Domains = dynamic(["fegrs.adidasabc.com","admin.xiongmaocs.help","blackcat880.shop","cheng770.cyou","oop.uuokxx.com","andxxxo.com","admin.xiongmaocs.mom","admin.xiongmaocs.pics","admin.fjbjwgyuyftg.qpon","admin.niaotong2.top","heilongyk.top","cz.gpgmk.com","cunzhang.krgdef.cn","bc.etlva.cn","jiaozhu.etlva.cn","mao.terh5.cn"]);
let RatHatEndpoints = dynamic(["/api/node/register","/api/data/credentials","/api/data/messages","/api/data/cipher","/api/tun/config","/api/v2/dev/tasks","/api/v2/dev/localServiceHeartbeat","/api/v2/dev/upload/video"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (RatHatC2Domains)
| extend MatchedEndpoint = extract(strcat("(", strcat_array(RatHatEndpoints, "|"), ")"), 1, RemoteUrl)
| project Timestamp, DeviceId, RemoteUrl, MatchedEndpoint
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where LocalIP == "127.0.0.1" and LocalPort == 7910
    | project DeviceId, LoopbackHit = 1
) on DeviceId
| sort by Timestamp desc

Sigma

title: RatHat C2 Domain Contact with Documented Endpoint Path
id: 4c8e1a3f-9d5b-4e7c-8a2f-6b1d3c9e5f07
status: experimental
description: Detects network contact with a published RatHat C2 domain (HTTPS admin/config or WSS command channel) combined with one of the documented C2 API endpoint paths used for enrollment, credential/SMS/lock-screen exfiltration, tunnel configuration, task polling, or screen-video upload.
references:
    - https://github.com/Zimperium/IOC/tree/master/2026-09-RatHat/
    - https://gbhackers.com/ai-powered-rathat-android-trojan-steals-bank-credentials/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-20
tags:
    - attack.command_and_control
    - attack.t1437
    - attack.t1604
    - attack.collection
    - attack.t1517
    - attack.t1636.004
    - attack.t1513
    - attack.credential_access
    - attack.t1461
    - attack.t1417.002
    - attack.tool.rathat
logsource:
    category: proxy
    product: android
detection:
    sel_domain:
        c-uri-host|contains:
            - 'fegrs.adidasabc.com'
            - 'admin.xiongmaocs.help'
            - 'blackcat880.shop'
            - 'cheng770.cyou'
            - 'admin.xiongmaocs.mom'
            - 'admin.niaotong2.top'
            - 'heilongyk.top'
            - 'cz.gpgmk.com'
    sel_endpoint:
        c-uri|contains:
            - '/api/node/register'
            - '/api/data/credentials'
            - '/api/data/messages'
            - '/api/data/cipher'
            - '/api/tun/config'
            - '/api/v2/dev/tasks'
            - '/api/v2/dev/localServiceHeartbeat'
            - '/api/v2/dev/upload/video'
    condition: sel_domain and sel_endpoint
falsepositives:
    - None expected; these are attacker-registered domains with no known legitimate use. Newly-observed sibling domains sharing the same registrar/naming pattern warrant the same treatment pending confirmation
level: critical

Known false positives:

• None expected for the listed exact-match C2 domains; if extending to newly-observed sibling infrastructure discovered via OSINT/community corroboration, treat those as medium-confidence until independently confirmed to avoid false positives on shared hosting providers

Tuning notes: Feed the C2 domain list from a lookup synced against Zimperium's c2.csv rather than hardcoding it, since RatHat operators rotate WSS command-channel hosts faster than HTTPS admin domains; consider a lower-confidence companion rule on the loopback-listener signature (127.0.0.1:7910) alone for devices where full URL/path visibility is unavailable (e.g. TLS-inspected-only proxy logs). TL_OSINT_Scan community corroboration for this threat currently shows 0 directly-matched IOCs and flags 37 related sibling domains from a separate malvertising campaign (fake Claude/Codex install-page lures, e.g. codex-notes.com, claude-macos-app.com) — that cluster is NOT confirmed RatHat infrastructure and should not be added to this rule without independent validation; monitor for future OSINT updates that directly corroborate RatHat's own C2 set.

• 🔒 RatHat — Malicious APK Hash or Cross-Vendor Detection Name Observed on Managed Fleet · unlock with TL Creds
• 🔒 RatHat — Native Go Binaries Staged and Executed from [indicator] · unlock with TL Creds
• 🔒 RatHat — getevent Touch-Coordinate Logging and [indicator] PIN/Pattern Reconstruction · unlock with TL Creds
• 🔒 RatHat — SessionInstaller API Abuse to Bypass Restricted-Settings During Sideload · unlock with TL Creds
• 🔒 RatHat — Uninstall-Resistant Auto-Reinstall and Silent Accessibility Re-Grant · unlock with TL Creds
• 🔒 RatHat — HTML-Injection Overlay Over Foregrounded Banking/Payment App · unlock with TL Creds
• 🔒 RatHat — Sideload Lure Followed by Accessibility Grant and Rapid Developer-Options Unlock · unlock with TL Creds
• 🔒 RatHat — ADB Wireless-Debugging Self-Pairing and Shell-Level Doze/Standby Manipulation · unlock with TL Creds

Indicators of compromise for RatHat Android AI banker

As of 2026-09-20, Threadlinqs Intelligence tracks 65 indicators of compromise for TL-2026-2592.

Sample indicators (3 of 65)

• Domain: fegrs[.]adidasabc[.]com
• URL: hxxps://x14hidgz0ez[.]s3[.]ap-south-1[.]amazonaws[.]com/Xr9HBk23fX.apk
• File hash: 018fca3266c87c10d4f46930878ffbe5155ae4a457c875d1e22682a80d7118a5

Defanged, TLP:CLEAR. Full set of 65 indicators: unlock with TL Creds.

How RatHat Android AI banker works

It abuses Accessibility permissions to silently enable Wireless Debugging, self-pairs with the local ADB daemon to gain shell-level control, drops two masqueraded Go-based native binaries that persist independently of the visible app (including one that auto-reinstalls the malware after uninstall via a fake Google Play failure overlay), and steals banking credentials, lock-screen PINs/patterns, and SMS-based MFA codes via HTML-injection overlays, raw touch-input logging, and SMS/notification interception. Zimperium's published IOC set documents 256 malicious APK hashes and 16 live C2 domains, and a follow-up report puts at least 162 malicious apps in active contact with the attacker infrastructure.

RatHat is a newly documented Android banking trojan, analyzed and named by Zimperium's zLabs research team in a report published September 16, 2026, that pairs live generative-AI-driven UI automation with abuse of two legitimate Android subsystems -- the Accessibility Service and Android Debug Bridge (ADB) Wireless Debugging -- to achieve persistent, shell-level control of infected devices and steal financial credentials.

Infection begins with social engineering: victims are lured via smishing (SMS phishing) messages and malvertising campaigns to deceptive third-party download portals and phishing sites that serve a malicious APK disguised as a legitimate app. Zimperium's IOC data shows a live distribution site, kingbss.com, pushing the payload under the fake app name "Nexus One"; other researchers separately observed builds masquerading as Disney+, ZEE5, and Chrome, with one APK hosted directly on AWS S3 (x14hidgz0ez.s3.ap-south-1.amazonaws.com) and fronted via the phishing subdomain sel6bu6eft06.primevoria.com. After sideloading, the app exploits native SessionInstaller APIs to bypass Android's restricted-settings and Accessibility Service protections during installation, then displays fake warnings (e.g., claiming a network restriction or a financial-benefit requirement, or a bogus Google Play Store page) to coerce the victim into granting Accessibility Service permission.

Once Accessibility access is granted, RatHat's automation layer (internally staged via a component multiple outlets refer to as "SystemHelper") serializes the device's live Accessibility node tree into XML and sends it to a generative-AI assistant -- the Zimperium report deliberately declines to name the specific model or provider, describing it only as "one of the world's most popular Generative AI assistants," but researchers found LLM prompts written in Chinese/Mandarin, consistent with their assessment that RatHat is operated by China-based threat actors; secondary reporting from PCRisk and Infosecurity Magazine independently identifies the assistant as Google Gemini, though this is not confirmed in Zimperium's own primary write-up. The AI resolves on-screen coordinates and text and returns navigation instructions (e.g., SCROLL_DOWN), which the malware executes as synthetic taps via Android's accessibility input-injection APIs. Using this technique the malware autonomously taps Build Number seven times to unlock Developer Options, enables Wireless Debugging, opens the ADB pairing dialog, and reads the temporary six-digit pairing code and dynamic port directly off the screen. It then authenticates to the local ADB daemon (via an embedded libadb-android implementation) and obtains a shell in /data/local/tmp -- escaping the normal Android application sandbox entirely without exploiting any software vulnerability.

From that shell, RatHat drops two native ELF binaries disguised as native libraries: liblocal-service.so, a Go-based privileged local agent that binds an HTTP command/telemetry server to 127.0.0.1:7910 and issues OS-level commands (dumpsys deviceidle whitelist, am set-standby-bucket, pm disable-user, pm install/uninstall) to exempt itself from Doze/battery restrictions and manage the app's install state; and libmedia_codec.so, a reverse-proxy client built on the open-source fatedier/frp project that establishes a persistent reverse tunnel to attacker infrastructure over both HTTPS and WSS, exposing the device's loopback services and interfaces to the operator and bypassing NAT/firewall boundaries. Because the Go agent runs outside the visible app's process/package lifecycle, it survives uninstallation of the RatHat app: it intercepts the uninstall-confirmation flow with a fake Google Play failure overlay, monitors installation state via scheduled alarms and account-sync watchdog components, and silently reissues pm install -r -g -i com.android.packageinstaller against a cached APK to reinstall the malware and re-grant Accessibility (via settings put secure enabled_accessibility_services / accessibility_enabled) without any further user interaction. A heartbeat check redeploys the local-service daemon if it is stopped.

For credential theft, RatHat monitors foreground-application activity and, when a targeted banking or payment app comes to the foreground, injects operator-supplied HTML content as a full-screen overlay to phish credentials directly. Named targets span Bank of America and unnamed Russian-language banking apps (per PCRisk) alongside WeChat Pay and Alipay, which present victims with Chinese-language "identity verification" screens requesting six-digit payment PINs. In parallel, the Go agent invokes Android's built-in getevent diagnostic utility to read raw /dev/input touch events (X/Y coordinates and timestamps) and correlates them against a bundled locateValues.json file containing precise keypad and pattern-lock geometry for major device brands, allowing it to reconstruct lock-screen PINs and pattern unlocks purely from touch coordinates -- a technique that bypasses FLAG_SECURE, custom keyboards, and other on-screen lock-screen protections; recovered credentials are internally tagged PASSWORD_QUALITY_TOUCH_POINTS. RatHat additionally registers an SMS receiver and abuses notification-listener access to intercept incoming SMS bodies (including one-time passwords and MFA codes), captures keystrokes and URLs typed into browser address bars, records the screen via the MediaProjection API with chunked video upload to the C2, and collects browsing history from Chrome, Brave, Opera, Edge, DuckDuckGo, and Samsung Internet, as well as an inventory of installed applications.

Command and control runs over HTTP/WebSocket with HMAC-SHA256 request authentication derived from a per-device key salt and a persistent heartbeat WebSocket. Documented endpoints include /api/node/register (enrollment), /api/data/credentials, /api/data/messages, /api/data/cipher (lock-screen material), /api/tun/config (FRP tunnel parameters), /api/v2/dev/tasks (task/command queue), /api/v2/dev/localServiceHeartbeat, /api/v2/dev/data/screen-monitor, /api/v2/dev/upload/video, plus operator evasion/block lists at /api/sapp and /api/bapp. Zimperium's published IOC repository (github.com/Zimperium/IOC, path 2026-09-RatHat) enumerates 256 distinct SHA-256 APK hashes, 16 live/recently-live C2 domains split between HTTPS admin/config endpoints (e.g., fegrs.adidasabc.com, admin.xiongmaocs.help, blackcat880.shop, cheng770.cyou) and WSS command-channel endpoints (e.g., admin.xiongmaocs.mom, admin.niaotong2.top, heilongyk.top, cz.gpgmk.com), and phishing/distribution infrastructure. A follow-up report (SSBCrack, Sept 20 2026) puts at least 162 distinct malicious applications observed actively communicating with this attacker-controlled infrastructure. Independent removal-guide research (PCRisk) also published a specific sample hash (SHA-256 018fca3266c87c10d4f46930878ffbe5155ae4a457c875d1e22682a80d7118a5) with cross-vendor AV detection names: Avast-Mobile (Android:Evo-gen [Trj]), Combo Cleaner (Android.Riskware.Agent.aDKHB), ESET-NOD32 (Android/Spy.Agent.EZF Trojan), and Kaspersky (HEUR:Trojan-Clicker.AndroidOS.Simpo.c).

The dropper itself employs four distinct anti-analysis techniques to resist static/dynamic triage: container tampering (declaring archive entries as directories or setting spurious ZIP-encryption flags to break Android's libziparchive parser), a manifest bomb (an undocumented 0x9999 chunk header injected into a 61MB AndroidManifest.xml to crash analysis tooling), DEX bytecode poisoning (pseudo-instructions carrying invalid element_width attributes), and dual Base64-based string encryption (StringFog plus StringCrypto) to hide strings and configuration, layered with six runtime anti-debugging/anti-instrumentation checks (debugger-attach detection, TracerPid inspection, FLAG_DEBUGGABLE/ro.debuggable checks, Frida port/process/library scanning, and root/Xposed/emulator artifact checks).

No CVE or CVSS score applies -- RatHat achieves shell-level device compromise entirely by abusing legitimate, user-grantable Android features (Accessibility Service, Wireless Debugging) combined with social engineering, not a software vulnerability.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406 Obfuscated Files or Information; T1406.002 Software Packing; T1407 Download New Code at Runtime; T1629 Impair Defenses; T1633.001 System Checks

Credential Access

T1417.002 GUI Input Capture

Discovery

T1418 Software Discovery

Command and Control

T1437 Application Layer Protocol

collection

T1453 Abuse Accessibility Features

initial-access

T1461 Lockscreen Bypass

Collection

T1513 Screen Capture; T1517 Access Notifications; T1533 Data from Local System; T1636.004 SMS Messages

defense-evasion

T1516 Input Injection; T1604 Proxy Through Victim

Execution

T1575 Native API; T1623 Command and Scripting Interpreter

Initial Access

T1660 Phishing

Remediation for RatHat Android AI banker

Immediate actions

• Audit which installed apps currently hold Accessibility Service permission and revoke access for any app that does not have a clear, legitimate need for it
• Disable Wireless Debugging / Developer Options on end-user and BYOD devices; where Wireless Debugging must remain enabled, review and revoke any ADB pairings that were not initiated by IT
• Block sideloading from third-party app stores and unknown sources, and ensure Google Play Protect scanning is enabled fleet-wide
• Treat any device that recently granted Accessibility access after an unsolicited SMS link or ad-driven APK download as potentially compromised: force credential rotation for banking/financial accounts accessed from that device and re-issue MFA secrets
• Block the published RatHat C2 and phishing/distribution domains (kingbss.com, app.tmgg01.top, primevoria.com subdomains, and the 16 Zimperium-published C2 domains) and the S3 APK-hosting path at network egress / DNS resolvers
• Scan managed fleets against the 256 published SHA-256 APK hashes and the cross-vendor detection names (Avast-Mobile, ESET-NOD32, Kaspersky, Combo Cleaner) via MTD/EDR tooling

Workarounds

• Use Mobile Device Management (MDM) policy to restrict which apps may request or hold Accessibility Service grants on managed fleets
• Enforce application allowlisting to block execution of APKs sideloaded from outside Google Play on corporate-managed devices

Longer-term hardening

• Deploy mobile threat defense (MTD) tooling capable of flagging Accessibility-service abuse, synthetic-tap automation, and unauthorized native-binary staging under /data/local/tmp
• Migrate SMS-delivered one-time passcodes to app-based authenticators or hardware security keys, which RatHat's SMS/notification-interception path cannot capture
• Add mobile EDR telemetry for anomalous local ADB pairing events, unexpected loopback HTTP listeners (e.g., 127.0.0.1:7910-style local command servers), and outbound reverse-proxy/tunnel traffic (frp-style, HTTPS/WSS) from managed devices
• Run recurring user-awareness training on smishing and malvertising lures that specifically request Accessibility permission grants or Wireless Debugging changes under a pretext of 'network restrictions' or financial rewards, and on fake-app lures impersonating Chrome, Disney+, ZEE5, or a bogus Google Play Store page

Affected and fixed versions

• Google — Android
  Vulnerable versions: Android 11; Android 12; Android 13; Android 14; Android 15; Android 16

Timeline of RatHat Android AI banker

• 2026-09-16 Zimperium publishes a public IOC repository (github.com/Zimperium/IOC, path 2026-09-RatHat) containing 256 SHA-256 APK hashes, 16 C2 domains (HTTPS admin/config and WSS command-channel), and phishing/distribution indicators including an AWS S3-hosted APK.
• 2026-09-16 Zimperium zLabs publishes the original locked-ioc-62 technical research report, disclosing the AI-driven Accessibility-tree automation chain, ADB self-pairing for shell access, and the locked-ioc-30/locked-ioc-37 native persistence components.
• 2026-09-17 GBHackers publishes a technical breakdown of the malware's "SystemHelper" component, detailing the automated Wireless Debugging activation and six-digit ADB pairing-code theft mechanics.
• 2026-09-17 Infosecurity Magazine, BleepingComputer, SecurityInformed, and CyberPress publish independent coverage summarizing Zimperium's locked-ioc-62 findings and the China-based attribution assessment; several outlets attribute the generative-AI component to locked-ioc-51, a detail not confirmed in Zimperium's own report.
• 2026-09-18 PCRisk publishes a removal guide identifying a specific sample (SHA-256 locked-ioc-1) with cross-vendor AV detection names, and identifies locked-ioc-57 as a live distribution site pushing the payload under the fake app name "locked-ioc-58," alongside locked-ioc-45 and Russian-language banking-app targeting.
• 2026-09-18 The Daily Hodl and The Hacker News publish follow-up coverage detailing locked-ioc-62's ADB-based persistence (auto-reinstall after uninstall) and the scope of data stolen via the C2 command set (SMS, credentials, files, lock-screen material, screen captures, keystrokes, installed-app inventory).
• 2026-09-19 GBHackers publishes a technical breakdown of the AI-powered locked-ioc-62 trojan's credential-theft and MFA-interception capabilities.
• 2026-09-20 Reporting as of this date describes locked-ioc-62's smishing and malvertising distribution campaigns, and its targeting of banking (including locked-ioc-45 and Russian-language banks), payment (locked-ioc-63 and locked-ioc-64), and cryptocurrency apps, as ongoing and active.
• 2026-09-20 SSBCrack reports at least 162 distinct malicious applications observed actively communicating with locked-ioc-62's attacker-controlled infrastructure, based on the published IOC set, and notes fake-Google-Play-Store lure pages as an additional distribution vector.

Sources cited for RatHat Android AI banker

• RatHat: AI-Powered Mobile Threat is Here for Your Credentials & Bank Accounts zimperium.com · Vendor report · 2026-09-16
• Zimperium/IOC — 2026-09-RatHat indicator repository (apks.csv, c2.csv, phishing.csv) GitHub · Code repository · 2026-09-16
• RatHat Malware (Android) - Malware removal instructions pcrisk.com · Blog · 2026-09-18
• New 'RatHat' Android Malware Leverages AI to Steal Financial Data infosecurity-magazine.com · News · 2026-09-17
• New RatHat Android malware uses AI to automate device control BleepingComputer · News · 2026-09-17
• Zimperium zLabs Uncovers RatHat Mobile Malware securityinformed.com · News · 2026-09-17
• New RatHat Android Malware Uses AI and ADB to Steal Banking Credentials and OTPs cyberpress.org · News · 2026-09-17
• RatHat Abuses Android Wireless Debugging to Gain Shell Access and Steal Banking PINs gbhackers.com · News · 2026-09-17
• New Android Malware Uses AI to Steal Banking Logins and Control Phones: Report dailyhodl.com · News · 2026-09-18
• RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall The Hacker News · News · 2026-09-18
• AI-Powered RatHat Android Trojan Steals Bank Credentials, PINs and MFA Codes gbhackers.com · News · 2026-09-19
• New AI-Powered Malware RatHat Poses Serious Threat to Android Users news.ssbcrack.com · News · 2026-09-20

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• FomoPeek iOS App Store Poisoning: Kernel Exploit Framework Steals Crypto Private Keys via Keychain Decryption Previous report
• PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2 Next report