Threat Research Team

Our team invests countless hours in the exploration, discovery and investigation of emerging trends such as AI and futuristic technology. Stay informed about the evolving landscape of cyberthreats through our diligent efforts and insights.

Threat Researcher at Gen

Research

<h4>Key Points&nbsp;</h4><ul><li data-list-item-id="e43a143fd054561c50dba51071686adff">Gen Threat Labs has been tracking GoFlateLoader, a widespread Golang loader used to deliver multiple infostealers, including Amatera, Remus, Lumma, Vidar and StealC.&nbsp;</li><li data-list-item-id="e3d3b5d0814ea5b26aa75a8d3d6013a39">GoFlateLoader appears both in x86 (32-bit) and x86-64 (64-bit) variants, matching the bitness of the payload it is supposed to execute.&nbsp;</li><li data-list-item-id="e51ccafcfb8c418d894aeb685004a0ba5">The loader is designed for in-memory payload execution and is deliberately inflated with a massive PE overlay to hinder detection</li><li data-list-item-id="ec4bafef8a1113d24bc2b4b3a943228d1">The two main delivery paths are via supposedly cracked software and a <a href="https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/" target="_blank" rel="noreferrer noopener">malicious TDS recently documented by Check Point Research</a>, which may redirect users to dedicated landing pages serving password-protected archives containing GoFlateLoader.&nbsp;</li></ul><h4>Introduction&nbsp;</h4>Not every threat that matters is technically sophisticated, and that is also the case with GoFlateLoader, which is a rather simple loader written in Go, whose sole purpose is to decode and execute the payload in memory. What stands out the most is not what the loader does but rather what it does not do – it comes without anti-debugging, anti-VM, or sandbox-evasion checks, and also lacks API hashing or CFG obfuscation, the kind of tricks that loaders almost always come with. Instead, GoFlateLoader relies on one of the simplest yet still effective tricks to stay under the radar – it appends a massive PE overlay at the end of the file, deliberately inflating the binary's size (hence the name GoFlateLoader).&nbsp;Nevertheless, it is important to understand that malware does not necessarily need to be elegant or stealthy. In the end, the only thing that matters to attackers is whether it can successfully deliver the final payload. And if that is the only metric, GoFlateLoader appears to be working fairly well for its operators, as we continue to see it widely distributed across our user base. Since the beginning of April, we have protected more than 33,000 unique users from it, with the most affected countries including Brazil, India, Argentina, Mexico, Turkey and Spain.&nbsp;

<h4>GoFlateLoader’s Execution Flow&nbsp;</h4>If we strip away the obfuscation noise that the Go compiler and the author’s decoy code add, the loader’s execution flow is short and linear:&nbsp;<ul type="disc"><li data-list-item-id="efa51af3b2859fd9c684efca0c82d3b66">Copy the encoded payload blob from the <code>.rdata</code> section onto the stack.&nbsp;</li><li data-list-item-id="e879bb970c6d1a81b8a42512222aceaa4">Decode the payload using a small, multi-stage, custom byte-level transformation into a valid PE.&nbsp;</li><li data-list-item-id="ebff4f340af15b75cbea0d682b26b7645">Parse the PE headers of the decoded payload (image base, image size, sections, data directories, etc.).&nbsp;</li><li data-list-item-id="e37fb26cad3d18a4a0c8bf9b2595d661f">Allocate an RWX memory region using <code>VirtualAlloc</code> with <code>MEM_COMMIT | MEM_RESERVE</code> and <code>PAGE_EXECUTE_READWRITE</code> flags, trying the payload’s preferred <code>ImageBase</code> first and falling back to an OS-assigned address if that fails.&nbsp;</li><li data-list-item-id="ebbde6d77cdc942c0a6bac79f4f8a6c28">Map the decoded payload into the allocated memory region by copying the PE headers first, then walking the section table and writing each section to its target virtual address.&nbsp;</li><li data-list-item-id="ed16738229e0f5c70a981c0c5f9b715f9">Apply relocations (only if preferred base mapping fails).&nbsp;</li><li data-list-item-id="e76cde4bae1be6c21b897c350c6fd15db">Resolve imports by walking the standard <code>IMAGE_IMPORT_DESCRIPTOR</code> table and rebuild the IAT in place via <code>LoadLibrary</code> and<code> GetProcAddress</code>.&nbsp;</li><li data-list-item-id="e786887a3d34fc7ce344ee8375944799e">Transfer execution to the final payload using Go’s <code>syscall.Syscall</code>.&nbsp;</li></ul>&nbsp;This is essentially a textbook example of manual PE loading with the payload reconstructed and executed entirely in memory so that it never touches the disk.&nbsp;&nbsp;

Notably, GoFlateLoader transfers execution to the final payload via <code>syscall.Syscall</code>. In Go, <code>syscall.Syscall</code> has the signature <code>Syscall(trap, nargs, a1, a2, a3)</code>, where <code>trap</code> is the function pointer to invoke, <code>nargs </code>is the argument count, and <code>a1</code>, <code>a2</code>, and <code>a3</code> are the first three arguments passed to the target function. Here, trap is set to point to the final payload’s entry point, <code>nargs</code> is set to <code>1</code>, and since the execution is transferred to that entry point, the remaining arguments serve only as filler values and are never used by the invoked payload. In other words, GoFlateLoader is not issuing a <code>syscall</code> at all, but abusing <code>syscall.Syscall</code> as a generic call gate to hand control to the payload.&nbsp;&nbsp;It is worth emphasizing that GoFlateLoader consistently sets these arguments to the hardcoded values <code>1</code>, <code>2</code>, <code>3</code>, and <code>4</code>, which is unusual enough to stand out as a potential detection opportunity (combined with other patterns).&nbsp;

The loader also carries substantial junk/decoy code, which varies across builds and serves no purpose other than padding the control flow and complicating static analysis.&nbsp;&nbsp;&nbsp;<h4>Inflated PE Overlay&nbsp;</h4>GoFlateLoader’s defining characteristic is its massive size (typically 700-950 MB), caused by an artificially inflated PE overlay appended to the original loader.&nbsp;

This is a deliberate design choice intended to bypass detection, as excessively large executable files may pose challenges for AVs and EDRs, primarily due to performance and resource constraints. As a result, to preserve performance and avoid noticeable impact to end users, these solutions often enforce practical file-size limits for deep scanning and/or emulation.&nbsp;The same logic extends to automated analysis pipelines – bloated files frequently cause timeouts during heuristic analysis and effectively prevent the sample from being uploaded to cloud-based sandboxes or threat intelligence platforms, which enforce their own strict upload limits to manage bandwidth and storage costs. A prime example is VirusTotal, which enforces a strict 650 MB upload limit. The fact that GoFlateLoader consistently sits just above this threshold strongly suggests that VirusTotal is one of the platforms it specifically aims to evade.&nbsp;&nbsp;In most cases, GoFlateLoader’s PE overlays are filled with null bytes, though we have also observed builds with random padding.&nbsp;&nbsp;

Crucially, adding such a PE overlay comes at virtually no distribution cost for attackers, as the inflated data compresses to a fraction of its original size (assuming constant padding).&nbsp;&nbsp;<h4>Delivered Final Payloads&nbsp;</h4>The final payloads distributed through GoFlateLoader are predominantly information stealers, with the most prevalent currently being Amatera, <a href="https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer" target="_blank" rel="noreferrer noopener">Remus</a>, and Lumma. Beyond these, we have also observed it distributing Vidar, StealC, and SvitStealer.&nbsp;GoFlateLoader comes in both x86 and x86-64 variants, with each variant matched to the architecture of the payload it is intended to execute.&nbsp;&nbsp;As for how GoFlateLoader binaries are distributed, we have observed at least two notable delivery paths. The first is through supposedly cracked software. The second involves the payload being served via <a href="https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/" target="_blank" rel="noreferrer noopener">the malicious TDS recently described by Check Point Research</a>, which redirects users to a landing page that offers a downloadable archive and separately displays the password required to extract it. This approach provides several advantages for the threat actor. First, compression significantly reduces the binary size due to the constant-padded PE overlay. Second, because the archive password is displayed separately on the landing page, it makes it harder for AV and EDR solutions to obtain it and decrypt the archive. As a result, the payload may remain concealed until the victim manually extracts it.&nbsp;&nbsp;&nbsp;<h4>Summary&nbsp;</h4>GoFlateLoader is a reminder that prevalence and sophistication are not the same thing. At its core, it is a rather simple manual in-memory PE loader written in Go, with no novel anti-analysis tricks under the hood. Whatever evasion it achieves comes not from obfuscation or other anti-analysis tricks but from its size – the appended PE overlay is built to slip past size-constrained scanners and automated analysis pipelines. Yet, despite its low level of sophistication, GoFlateLoader remains an active and relevant threat, used to deliver a wide range of prevalent information stealers.&nbsp;&nbsp;Gen products protect our users against both GoFlateLoader and the payloads it delivers.&nbsp;&nbsp;<h4>Indicators of Compromise (IoCs)&nbsp;</h4>Note: The files listed in the IoCs that are not archives all exceed 650 MB in size and are therefore not available on VirusTotal.&nbsp;b88c5744975d2abb447aecc6c090fee9f8580413f4612eecdc6ed1973e8a1739 (password-protected archive containing GoFlateLoader x64 variant loading Remus; pwd: 1234)&nbsp;ed5ae7f36453c5a23e9868a5729d67e0549a11f6dea54f5f52d654a8f51d4902 (archive containing GoFlateLoader x64 variant loading Remus)&nbsp;841c9297cb8a2e0ff89433d13c05bfc760eb2e98e251cb8fa785d2ad7cbac05f (archive containing GoFlateLoader x86 variant loading Amatera)&nbsp;ece7c48eb411b24f26762ede83badb4a644c41d5777129381ac2541804d64fc2 (archive containing GoFlateLoader x86 variant loading Lumma)&nbsp;421ce2d2f49c23bbe9f60ef3b9cd38d7eb912ce02e56a61837656210069bd9e2 (archive containing GoFlateLoader x64 variant loading Vidar)&nbsp;121c2dc793b3873f75a29ec02241f94136de19c049382a50a50d0d5b99507073 (GoFlateLoader x64 variant loading StealC)&nbsp;2415db5081cec9bfd14ad6da1a66169fd96f13a49010c319a73d1ed6fafd4efa (GoFlateLoader x64 variant loading Vidar)&nbsp;d9917ade3b4c125a95b5d3e6343cde26145dfbf569bd7e2a843fd0c6fc8ddc28 (GoFlateLoader x64 variant loading Remus)&nbsp;4cf6893756f441522b94b36f10e5de0e47aeed4743f95c51650746d1ecf97e3d (GoFlateLoader x64 variant loading SvitStealer)&nbsp;8b89d6c9152d3aab97aadd515ecb69ca72654db2f25425759ba4b646853d737d (GoFlateLoader x86 variant loading Lumma)&nbsp;90ce4ff9da23ac150da0a8e17930cab1e369aa349fdc1b65691b70369145664a (GoFlateLoader x86 variant loading Amatera)&nbsp;

 Intentionally Inflated Go Binaries That Use Massive PE Overlays to Bypass Detection

GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers

Security Evangelist at Gen

Malware Researcher

When we published the first part of this research, we said the investigation was still ongoing. That was not a closing line. We were already looking at the infrastructure, the signals behind the attacks, and the scale of the reservation data abuse we were seeing in our telemetry.&nbsp;Then something else happened.&nbsp;Friends, colleagues, and other contacts started forwarding us messages they had received from Booking.com. The messages warned that unauthorized third parties may have accessed information linked to their reservations. Shortly after, media outlets began reporting the same thing: Booking.com had notified affected customers, reset reservation PINs, and said the accessed information could include names, email addresses, phone numbers, booking details, and information shared with accommodations. Booking.com said financial information was not accessed from its systems.&nbsp;The timing mattered, but not because it started our investigation. It mattered because it publicly confirmed the kind of reservation-data exposure our first article had described from the attack side.&nbsp;<a href="https://us.norton.com/blog/online-scams/reservation-hijacking-scam" target="_blank">Reservation Hijack scams</a> work because criminals do not have to guess. A traveler receives a message about a real booking. The message contains details that make sense: the right accommodation, the right trip context, sometimes the right contact information. The link then opens a fraudulent page built around the same accommodation.&nbsp;A generic <a href="https://us.norton.com/blog/online-scams/what-is-phishing " target="_blank">phishing message</a> has to create trust from nothing. This scam steps into a relationship that already exists between the traveler, the booking platform, and the accommodation.&nbsp;While those public warnings were appearing, Gen Threat Labs continued canvassing the data we had available: blocked URLs, fraudulent landing pages, SMS messages, emails, WhatsApp messages, in-app message evidence, and other signals connected to attacks we had already stopped. We used AI-assisted analysis to connect pieces that would otherwise remain scattered: messages, landing pages, accommodation names, URLs, templates, and infrastructure patterns. Human analysts reviewed the results and separated what we could prove from what we could only suspect.&nbsp;The result is a much clearer picture.&nbsp;We identified more than 350 compromised accommodations linked to the Reservation Hijack scam flows, spread across 50 countries. These were not abstract indicators or generic travel-themed pages. In the cases we analyzed, victims had already received reservation-specific information before being pushed to a fraudulent page customized around the accommodation tied to that booking.&nbsp;That is the difference between ordinary travel phishing and this model. The attackers are not guessing who is traveling. They already have enough reservation context to make the fraud feel normal.&nbsp;And they are doing it at scale.&nbsp;

<h3>How we connected the evidence&nbsp;</h3>The second phase of our investigation was already underway when Booking.com’s customer notifications started circulating publicly.&nbsp;Gen’s view of this activity comes from attacks we blocked before they could complete. No single signal tells the whole story. An SMS or WhatsApp message may show the <a href="https://us.norton.com/blog/emerging-threats/what-is-social-engineering " target="_blank">social engineering</a>. A URL may show the redirect path. A landing page may show the accommodation being impersonated. An in-app message may show where the attacker entered the trusted communication flow. A repeated page structure may link incidents that look separate at first.&nbsp;Put together, those pieces show how reservation data moves from compromise to fraud.&nbsp;AI helped us work through that evidence at scale. We used it to normalize accommodation names, cluster similar messages, compare landing-page structures, connect URLs with page content, and flag repeated patterns across channels. This was not “AI says these attacks are connected.” It was AI-assisted triage followed by human review.&nbsp;From that process, we extracted and cleaned accommodation names from captured fraudulent landing pages and identified 350 compromised accommodations.&nbsp;We use “compromised accommodations” carefully here. It means reservation context tied to those accommodations was compromised and used in an attack flow we intercepted. The source of compromise may vary: a hotel account, a booking platform partner account, an email inbox, a property management system, a guest messaging workflow, or a third-party service provider.&nbsp;The end result for the traveler is the same. Criminals had access to information that should have stayed inside the booking relationship.&nbsp;This is also a conservative number. It only includes attacks where we had enough evidence to connect the flow to a specific accommodation. It does not include people who received a message and never clicked, attacks outside our telemetry, landing pages we did not capture, or cases where the accommodation name could not be reliably extracted.&nbsp;So 350 is not the size of the problem. It is the part we could see clearly.&nbsp;<h3>From scam pattern to repeatable operation&nbsp;</h3>A single compromised hotel account can explain a few victims. A copied phishing kit can explain a short campaign. Hundreds of accommodation-specific scam flows across 50 countries point to something more organized.&nbsp;The model we see is consistent.&nbsp;Reservation context enters the fraud chain, sometimes through compromised accommodation-side accounts, inboxes, partner tools, or data obtained from other criminal actors. That context is then used to contact travelers with details that make the message feel legitimate.&nbsp;The wording, the property, the country change. The logic does not.&nbsp;That is why this follow-up is not simply “we found more cases.” The first article explained <a href="https://www.gendigital.com/blog/insights/research/reservation-hijack-scam">how Reservation Hijack scams work</a>. This one shows how far the model has spread.&nbsp;<h3>A worldwide footprint, led by Europe&nbsp;</h3>The highest number of compromised accommodations in our dataset were linked to Germany, followed by France, the United Kingdom, Italy, Spain, and the United States.&nbsp;Germany accounted for 49 compromised accommodations in the dataset. France followed with 35, the United Kingdom with 31, Italy with 24, Spain with 20, and the United States with 19.&nbsp;Together, the top five European countries, Germany, France, the United Kingdom, Italy, and Spain, accounted for 159 compromised accommodations, about 45% of the full dataset.&nbsp;

The European concentration makes sense. Europe has a dense travel market, a high volume of cross-border bookings, many independent and mid-sized accommodation providers, and a strong dependency on online booking platforms and pre-arrival guest messaging.&nbsp;Those conditions give criminals useful cover. Travelers expect messages before arrival. They expect payment questions, check-in instructions, policy reminders, and booking updates. A well-timed fake message does not feel unusual.&nbsp;But the country distribution also shows that this is not a single-region problem. The activity spreads across 50 countries, with a long tail of destinations beyond the largest clusters.&nbsp;

That long tail matters. It suggests the model is not limited to a few obvious tourist destinations or a handful of famous hotel brands. Once criminals have access to reservation data and a working scam flow, the same approach can be adapted to different countries, languages, property types, and booking habits.&nbsp;The property does not need to be famous. It only needs to be real, tied to a real reservation, and recognizable to the victim.&nbsp;<h3>Not just hotels&nbsp;</h3>Hotels make up the largest share of the dataset, but they are not the whole story.&nbsp;We identified compromised accommodations across several property types: hotels, aparthotels, apartments, inns, motels, lodges, resorts, guesthouses, B&amp;Bs, hostels, villas, bungalows, and capsule hotels.&nbsp;

This is a useful reminder of how fragmented the travel ecosystem really is. A traveler may book a large hotel chain, a family-run guesthouse, a serviced apartment, a hostel, or a villa through similar platforms and messaging flows.&nbsp;From the traveler’s point of view, the trust model is almost the same. They made a booking. They expect communication. They may not know whether the message came from the property, the platform, a channel manager, a property management system, or a compromised account sitting somewhere in between.&nbsp;That is exactly the gap criminals are abusing.&nbsp;<h3>How big could this problem be?&nbsp;</h3>To understand the potential scale of Reservation Hijack scams, we looked at the accommodation properties appearing in our research dataset.&nbsp;In total, we identified 350 accommodation entries linked to reservation hijack scam activity. These were not all the same kind of business. The dataset included hotels, aparthotels, resorts, hostels, guesthouses, villas, apartments and other accommodation types. For each one, we estimated the number of rooms, units, beds or capsules, depending on the property type, and used that to calculate the likely maximum guest capacity.&nbsp;Across the deduplicated dataset, these properties represented an estimated maximum capacity of around 82,000 guests at any given time. Using a conservative occupancy rate of 50% and an average length of stay of 2.5 nights, this translates into approximately 6 million guest stays per year.&nbsp;That does not mean 6 million people were scammed. It does not mean 6 million people had their data exposed. What it shows is the size of the opportunity criminals may be looking at when they compromise accommodation or booking communication channels.&nbsp;A single compromised workflow can give scammers something much more valuable than a random phone number or email address. It can give them context: the name of the accommodation, the dates of the stay, the booking amount, the channel the guest expects to be contacted through, and the right moment to create urgency.&nbsp;That is why Reservation Hijack scams are so convincing. The scam does not feel like spam. It feels like part of the trip.&nbsp;

<h3>The activity does not look random&nbsp;</h3>We are still investigating the infrastructure behind these attacks, so we are not attributing the activity to a named group.&nbsp;But the evidence does not look like hundreds of unrelated actors randomly copying one another.&nbsp;Across the dataset we analyzed, the same fingerprints kept appearing. Many pages used the same internal paths for scripts, images and styles. Several included the same unusual overlay component, repeated internal asset paths, and the same card-validation language, including claims that funds would be reserved and refunded within 10 minutes.&nbsp;The pages were also built to look specific to the victim. Hotel names appeared in page titles and visible content. Prices varied from one case to another. Check-in and check-out dates were inserted into the page. In some cases, page metadata and images were synchronized with the accommodation being impersonated. The evidence points to a repeatable process for turning reservation context into property-specific phishing pages. Taken together, those patterns are consistent with a phishing kit designed to generate accommodation-specific pages at scale, rather than pages built manually for each victim.&nbsp;The phishing pages also included a fake live support chat. To the victim, it looked like part of the booking or payment process, but it was controlled from the phishing infrastructure. The payment step could therefore become a live interaction: someone behind the page could react to the victim’s input, ask for another card, explain away a failed “validation”, push the victim to continue, or try to capture a one-time code while the victim still believed they were talking to booking support.&nbsp;Some of the infrastructure also uses legitimate internet services, including services such as Cloudflare, to place a layer between the visible scam page and the systems behind it. That does not make those services malicious. It means criminals are abusing the same infrastructure that normal websites use, including protective layers that can obscure hosting details, traffic paths, and backend systems.&nbsp;For investigators, this kind of setup makes the infrastructure harder to trace. For travelers, it removes many of the usual warning signs. They see a page that loads normally, shows the right accommodation, includes a support chat, and refers to the trip they actually booked. At that point, many people will treat the request as part of the reservation process, even when it is not.&nbsp;<h3>Correct information is not proof of legitimacy&nbsp;</h3>For years, people have been told to watch for bad spelling, odd sender names, generic greetings, and suspicious links. That advice still helps, but it does not solve this problem.&nbsp;A message can include the right accommodation, the right destination, and details from a real stay, and still be malicious. A page can show the correct hotel name, dates, and a plausible payment amount, and still be fake. A request can arrive at the moment when a traveler expects a check-in or payment message, and still be fraud.&nbsp;Page behavior can create false confidence too. In some of the phishing pages we analyzed, the fake support chat looked like part of the booking or payment process. If the victim had a question, or if the card “validation” failed, the page could keep the interaction going instead of simply collecting data and stopping there.&nbsp;That is what makes Reservation Hijack scams difficult for travelers to judge. The victim is not being tricked only by a fake brand or a fake website. They are being pushed through a process built around real context, at the moment when that context feels normal.&nbsp;Travelers expect hotels and booking platforms to contact them. They expect last-minute requests, check-in instructions, payment checks, ID forms, and confirmation messages. Criminals are not fighting that expectation. They are using it.&nbsp;<h3>What travelers should do&nbsp;</h3>The safest rule is simple: do not treat correct booking information as proof that a message is legitimate.&nbsp;If a message asks you to verify payment details, confirm a reservation, re-enter card information, pay a balance, reset a PIN, or avoid cancellation, do not use the <a href="https://us.norton.com/blog/online-scams/i-clicked-on-a-phishing-link" target="_blank">link in the message</a>.&nbsp;Open the booking platform or hotel app directly. Go to the official website yourself. Use contact details from the original booking confirmation. If needed, call the property using a verified number. Check whether the same request appears inside your official booking account.&nbsp;This applies even if the message mentions the right hotel, the right destination, or details from your stay.&nbsp;Booking.com has told customers that it will not ask guests to share credit card details by email, phone, WhatsApp, or text, or ask for a bank transfer that differs from the payment policy in the booking confirmation.&nbsp;If you already entered payment details into a suspicious page, contact your bank immediately, freeze or cancel the card, and monitor for follow-on fraud. Criminals may reuse the card data later, or sell it to others.&nbsp;<h3>What accommodations should take from this&nbsp;</h3>For hotels and other accommodation providers, this is not only a guest-awareness issue. Guest communication has become part of the attack surface.&nbsp;The systems and workflows between the property and the guest are now valuable targets. That can include hotel staff accounts, booking platform partner accounts, email inboxes, property management systems, guest messaging tools, channel managers, and third-party service providers.&nbsp;The lures we have seen on the accommodation side are not exotic. They look like normal hotel work. Some impersonate Booking.com and claim there is a guest complaint waiting for a response. Others say that a paid reservation needs urgent verification, or that the property’s visibility or ranking may be affected if staff do not act quickly. We have also seen payment and invoice-themed messages designed to make staff open attachments or documents that can lead to credential theft or <a href="https://us.norton.com/blog/malware/signs-of-malware" target="_blank">malware infection</a>.&nbsp;

That is why the first visible sign of a Reservation Hijack scam may not be the message sent to the guest. It may start earlier, with an email to a shared hotel inbox, a fake partner-support notice, a malicious attachment, or a document that looks like part of normal accounting or reservation handling. Once reservation context is obtained, whether directly or through another actor in the criminal ecosystem, it can be used later to make guest-facing scams much more convincing.&nbsp;For accommodation providers, staff training needs to cover the workflows criminals are actually abusing. Urgent complaints, reservation-verification requests, payment advice emails, invoice notifications, security-update prompts, and any message asking staff to open an attachment, enable content, sign in again, or act under time pressure should all be treated as possible entry points into the same fraud chain.&nbsp;The defensive work starts with account protection, but it should not stop there. Accommodation providers need strong <a href="https://us.norton.com/blog/account-safety/multi-factor-authentication" target="_blank">multi-factor authentication</a>, tight control over who can access guest data, monitoring for unusual logins or message patterns, and a clear process for responding when an account may have been abused. The devices used to manage reservations, guest messages, invoices and payment-related emails should also be protected with reliable security protection. Some of the lures we observed were designed to make staff open attachments or documents that could install malware or steal credentials. In those cases, <a href="https://us.norton.com/antivirus" target="_blank">antivirus</a> or endpoint protection may be the last barrier before a compromised inbox becomes a compromised booking workflow.&nbsp;Payment-related communication deserves special attention. If a guest receives a payment or verification request, there should be a reliable way to confirm whether it is real. If an account is suspected of being compromised, guests need to be warned quickly and clearly.&nbsp;The reputational damage can be painful. Even when the property is also a victim, the traveler may remember the incident as “the hotel message that stole my card details.” That makes workflow security part of customer trust.&nbsp;<h3>What the wider travel ecosystem should learn&nbsp;</h3>Reservation Hijack scams sit between several parts of the travel industry. The booking platform may see unusual partner activity. The hotel may see confused guests. The traveler sees a convincing message. The bank sees card fraud. A security company sees the landing page.&nbsp;Each view is partial, and that delay helps the scam continue.&nbsp;The useful signals are often scattered: unusual partner logins, repeated payment-verification language, guest-message spikes, reused templates, fake landing pages, redirects, and infrastructure overlaps. Sharing those signals faster would make it easier to see when separate complaints are really part of the same operation.&nbsp;One compromised accommodation can look like a local incident. Hundreds of compromised accommodations across 50 countries point to a repeatable abuse model.&nbsp;<h3>The next phase of travel fraud&nbsp;</h3>Reservation Hijack scams exploit a simple mistake in how we judge trust online.&nbsp;Travelers think: “This message knows my booking, so it must be real.”&nbsp;Criminals know: “If we have the booking context, the victim will do much of the trust work for us.”&nbsp;The message does not have to be perfect. The website does not have to be flawless. The attacker does not need to convince the victim from zero. They only need to appear inside a relationship that already exists.&nbsp;Our latest data shows that this model has spread well beyond isolated cases. We identified 350 compromised accommodations across 50 countries, covering hotels, apartments, hostels, resorts, guesthouses, villas, and other accommodation types. Together, those properties represent a large travel footprint and millions of estimated annual guest interactions.&nbsp;The investigation is still ongoing. We are continuing to analyze infrastructure, campaign overlaps, and the clues suggesting connected activity behind parts of the operation.&nbsp;For travelers, the lesson is simple.&nbsp;Trust your booking. Do not automatically trust the message.&nbsp;

After our first report, Booking.com began warning customers that reservation data had been accessed. Our continuing investigation shows how criminals are using that data at scale. 

When Hotel Scams Know Your Booking: 350 Compromised Accommodations Across 50 Countries 

Attackers replaced selected official download links with malicious installers that deployed a Python bot, r77 rootkit components, and Windows policy-based defense evasion.On May 6, 2026, attackers compromised the official JDownloader website and swapped download links to serve trojanized installers. The JDownloader developers <a href="https://www.reddit.com/r/jdownloader/comments/1t6goqe/is_the_website_hacked/">confirmed the breach</a> within hours, restored clean files, and disclosed a timeline, but acknowledged they didn't know what the malicious installers actually do. We took the malware apart to answer that question.&nbsp;What we found goes well beyond a typical trojanized installer. The payload is a multi-component attack framework: a Python bot protected by PyArmor v9, an r77 rootkit stager with AMSI bypass, and a Windows Defender Application Control (WDAC) policy that blocks 50 security executables from running, including Avast, AVG, Avira, Windows Defender, HitmanPro, and Kaspersky Virus Removal Tool. We reversed the full C2 protocol from the obfuscated Python bytecode and recovered the campaign configuration from the dropper's encrypted strings.&nbsp;<h2>The infection chain</h2>The trojanized installer is unsigned. Windows SmartScreen blocks it, and users who ran it had to manually bypass the warning. Inside, it wraps the legitimate JDownloader installer alongside an XOR-encrypted second-stage PE:

Stage 2 acts as the campaign's quartermaster. It deploys five components from XOR-encrypted resources embedded in its PE (key: <code>fywo</code>):<table class="table"><thead><tr><th>Component</th><th>Purpose</th></tr></thead><tbody><tr><td>PyArmor bot</td><td>The main payload, a Python script with obfuscated bytecode</td></tr><tr><td>PyArmor runtime</td><td>DLL that decrypts the bot's bytecode at execution time</td></tr><tr><td>r77 rootkit stager</td><td>Native x86 PE that hides the bot's process, files, and registry keys</td></tr><tr><td>WDAC Code Integrity policy</td><td>Blocks 50 AV/EDR executables from running after reboot</td></tr><tr><td>Python 3.14.3 installer</td><td>The legitimate Python runtime (needed to run the bot)</td></tr></tbody></table>Before doing any of this, Stage 2 calls <code>WaitForSingleObject</code> with a 300-second timeout — three times in sequence. This 5-minute-per-call delay is designed to outlast automated sandboxes, which typically give samples 2-5 minutes of execution time. One sandbox vendor recorded an 8-minute total wait before any malicious behavior appeared.&nbsp;<h2>Killing your antivirus before it can fight back</h2>The most operationally significant component is the WDAC Code Integrity policy.Windows Defender Application Control (WDAC) policies tell the operating system which executables are allowed to run. The attackers deploy a deny-list policy to <code>%WINDIR%\System32\CodeIntegrity\SIPolicy.p7b</code> that blocks 50 executable paths across six security vendors plus core Windows security services:<table class="table"><thead><tr><th>Target</th><th>Blocked executables</th></tr></thead><tbody><tr><td>Avast</td><td>AvastSvc.exe, AvastUI.exe, afwServ.exe, aswEngSrv.exe, aswidsagent.exe, aswToolsSvc.exe, wsc_proxy.exe, Icarus components, Overseer</td></tr><tr><td>AVG</td><td>All executables under Program Files\AVG\Antivirus</td></tr><tr><td>Avira</td><td>Security, VPN, Fallback Updater, Optimizer Host, Endpoint Protection SDK</td></tr><tr><td>Windows Defender</td><td>MsMpEng.exe, MpCmdRun.exe, MpDefenderCoreService.exe</td></tr><tr><td>Windows Security</td><td>SecurityHealthHost.exe, SecurityHealthService.exe, SecurityHealthSystray.exe</td></tr><tr><td>Windows Update</td><td>MoUsoCoreWorker.exe, wuauclt.exe, wusa.exe</td></tr><tr><td>Others</td><td>HitmanPro, Kaspersky Virus Removal Tool, Farbar Recovery Scan Tool</td></tr></tbody></table>After the next reboot, none of these executables can start. The AV service is effectively dead. It won't run, it can't scan, and Windows Update can't push signature updates. One victim in the Reddit thread reported that Windows Defender disappeared entirely after running the trojanized installer.This is a known but uncommon TTP (MITRE T1562.001). It requires the installer to run elevated, which the SmartScreen bypass dialog would have prompted for. Users who clicked through both warnings — SmartScreen and UAC — gave the malware everything it needed.<h2>&nbsp;</h2><h2>How the dropper provisions the bot</h2>Stage 2's strings are all XOR-obfuscated with the same <code>fywo</code> key used for its resources. After deobfuscation, we recovered 122 strings including registry paths, API names, and encrypted configuration values.The dropper writes the bot's initial configuration to <code>HKCU\SOFTWARE\Python</code>. Both the registry value names and data are RC4-encrypted and hex-encoded — making the registry entries look like random hex strings to casual inspection. We recovered two configuration values:<ul><li data-list-item-id="e15e9100cccadef17d91598e244b0b038">CampaignID a unique identifier for this campaign, used during bot registration with the C2 server.</li><li data-list-item-id="e7a2666057614636498fba93e483028cf">DDRList six dead-drop resolver URLs that the bot uses to discover its C2 servers (detailed in the next section).</li></ul>Notably, the dropper does not write a C2 server list directly. The bot discovers its command-and-control addresses exclusively through the dead-drop resolver mechanism — a design choice that makes the infrastructure resilient to takedowns.&nbsp;<h2>Dead-drop resolvers: how the bot finds its C2</h2>A dead-drop resolver (DDR) is an intermediary, a legitimate web page where the operator publishes encrypted C2 addresses. The bot fetches the page, extracts and decrypts the content, and connects to whatever C2 servers it finds. If the operator needs to rotate infrastructure, they update the DDR page and every infected machine follows automatically.The bot reads its DDR list from the registry, fetches each URL, and RC4-decrypts the page content. Valid payloads start with the prefix <code>VAL:</code> followed by a semicolon-separated list of C2 URLs.We extracted all six dead-drop resolver URLs from the dropper and probed them:<table class="table"><thead><tr><th>URL</th><th>Status</th><th>Decrypted content</th></tr></thead><tbody><tr><td><code>telegra[.]ph/tr02-05-02</code></td><td>Live</td><td>C2 list: parkspringshotel[.]com + auraguest[.]lk</td></tr><tr><td><code>telegra[.]ph/ki06-05-02</code></td><td>Live</td><td><code>VAL:XX</code> — placeholder for future C2 rotation</td></tr><tr><td><code>rentry[.]co/zzk7opdu</code></td><td>Live</td><td>Same C2 list</td></tr><tr><td><code>rentry[.]org/wayc2qqz</code></td><td>Live</td><td><code>VAL:XX</code> — placeholder</td></tr><tr><td><code>codeberg[.]org/etienne74/guix/...</code></td><td>404</td><td>Removed or never created</td></tr><tr><td>`2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion/t`</td><td>Not probed</td><td>Tor hidden service DDR</td></tr></tbody></table>The operator has two live C2 servers and four reserve dead-drop pages — two stubs ready for C2 rotation and one Tor fallback. If the current C2 infrastructure gets burned, the operator updates a Telegraph or Rentry page and every infected machine picks up the new address on its next poll cycle.Beyond the dead-drop mechanism, the bot has a domain generation algorithm (DGA) as a last-resort fallback. It combines four seeds (<code>XNerWs4I</code>, <code>e55gegnW</code>, <code>RjWN0Y9m</code>, <code>AemOU1co</code>) with 14 TLDs and an ISO-week-based rotation to produce 56 candidate domains per week. We probed all current DGA domains — none are registered. The operator is running purely on dead-drop infrastructure for now, but the DGA ensures the botnet can survive even if all resolver pages and C2 servers are taken down simultaneously.&nbsp;<h2>The C2 protocol: RSA-OAEP wrapping AES-GCM</h2>We reversed the bot's full communication protocol from the PyArmor-protected bytecode. It uses a layered encryption scheme designed to prevent passive interception and session tampering:

The bot wraps a fresh AES-256 key with the hardcoded RSA-2048 public key (OAEP, SHA-256) and sends it to the C2. The server proves possession of the private key by returning <code>"ok"</code> encrypted with AES-GCM. From that point, every message in both directions is AES-256-GCM encrypted with a per-direction sequence counter as authenticated associated data — preventing replay and reordering.After the handshake, the bot registers with the campaign ID provisioned by the dropper. The server returns a <code>bot_id</code> and <code>bot_pass</code> that the bot stores in the registry for subsequent polling. The bot's primary capability is arbitrary Python code execution — the attacker can ship any Python code and the bot will run it and return the output.All identified C2 and staging servers are compromised <a href="https://qloapps.com/">QloApps</a> hotel reservation websites:<table class="table"><thead><tr><th>Domain</th><th>Role</th><th>IP</th><th>PHP</th><th>Location</th></tr></thead><tbody><tr><td><code>parkspringshotel[.]com</code></td><td>C2 panel</td><td>172.96.172[.]91</td><td>8.3.30</td><td>Ghana</td></tr><tr><td><code>auraguest[.]lk</code></td><td>C2 panel</td><td>209.133.215[.]178</td><td>8.3.30</td><td>Sri Lanka</td></tr><tr><td><code>checkinnhotels[.]com</code></td><td>Linux payload staging</td><td>66.29.137[.]25</td><td>7.4.33</td><td>—</td></tr></tbody></table>The two C2 servers share identical JARM fingerprints and run the same PHP version, confirming the same C2 panel software is deployed on both. The third domain, <code>checkinnhotels[.]com</code>, was used to host the Linux payload disguised as an SVG file (<a href="https://www.bleepingcomputer.com/news/security/jdownloader-site-hacked-to-replace-installers-with-python-rat-malware/">BleepingComputer</a>). All three run QloApps — an open-source hotel booking CMS — suggesting the attacker specifically targets this software to build their infrastructure. None of the domains had malicious detections on VirusTotal at the time of discovery. We confirmed both C2 servers remain operationally live as of May 11.<h2>&nbsp;</h2><h2>The r77 rootkit stager</h2>The rootkit stager is a 176 KB native x86 PE based on the open-source <a href="https://github.com/bytecode77/r77-rootkit">r77 rootkit</a>. It contains an embedded .NET assembly that performs four operations:<ol><li data-list-item-id="e9ca3772c2bd6052d86931268e23d036a">AMSI bypass — a PowerShell cradle patches <code>AmsiScanBuffer</code> in memory, disabling Windows' Antimalware Scan Interface before any script payload runs.</li><li data-list-item-id="e01c27cd4c721b2dabe18b819d05c84fe">Reflective DLL injection — injects the r77 hooking DLLs (32-bit and 64-bit variants) into <code>winlogon.exe</code>. These DLLs hook Windows API functions to hide any process, file, or registry key whose name starts with the <code>$77</code> prefix.</li><li data-list-item-id="e254d7da7ebd6dfd7d57f7c5f67760ba3">Registry persistence — stores the stager assembly as a binary blob in <code>HKLM\SOFTWARE\$77stager</code> and reloads it at every boot via .NET reflection.</li><li data-list-item-id="ef200c38559748bd535edaf6a0d5aa3d5">Service creation — installs a Windows service (<code>$77svc</code>) to ensure the rootkit survives reboots independently of the registry mechanism.</li></ol>Once r77 is active, the <code>$77</code> prefix acts as an invisibility cloak. The Python bot calls <code>r77_hide_self()</code> and <code>r77_hide_registry_path()</code> to rename its own process and registry hive with this prefix, making them invisible to Task Manager, <code>regedit</code>, and most security tools.<h2>&nbsp;</h2><h2>The Python bot under PyArmor v9</h2>The final payload is a Python script protected by <a href="https://pyarmor.dashingsoft.com/">PyArmor</a> v9, a commercial bytecode obfuscation tool. PyArmor encrypts each function's bytecode individually and decrypts it at runtime through a native DLL — making static analysis significantly harder than standard Python malware.We built a custom tool to decrypt and disassemble the protected bytecode, recovering 30 functions totaling 7,326 lines of disassembly. The bot is cross-platform (Windows and Linux), uses gevent for asynchronous I/O, and handles the full lifecycle: configuration management, C2 discovery via dead-drop resolvers and DGA, encrypted communication, task execution, and rootkit integration.The bot's primary capability is executing arbitrary Python code received from the C2 server. Combined with the Python 3.14 runtime installed by the dropper, this gives the operator the ability to deploy any follow-on payload — keyloggers, credential stealers, lateral movement tools — without needing to push new binaries to the victim.<h2>&nbsp;</h2><h2>Impact and recommendations</h2>Users who downloaded JDownloader from the official website between May 6 and May 7, 2026, using the "Download Alternative Installer" links (Windows) or the Linux shell installer link are potentially compromised. The <a href="https://jdownloader.org/incident_8.5.2026.html">official incident report</a> lists eight malicious installer hashes across x86/amd64 and multiple JRE versions. The attackers exploited an unpatched CMS vulnerability to swap download links — the actual installer files hosted externally were never modified. In-app updates, macOS downloads, and package manager installs (Flatpak, Winget, Snap) were not affected.The Linux attack chain, [first reported by BleepingComputer](https://www.bleepingcomputer.com/news/security/jdownloader-site-hacked-to-replace-installers-with-python-rat-malware/), follows a different delivery path. We downloaded the trojanized shell installer and its payload to verify the claims and dig deeper.d. The modified install4j script requires root, checks for x86_64 architecture, and downloads a 20 MB tar.gz from <code>checkinnhotels[.]com/img/logo1.svg</code> (disguised with <code>Content-Type: image/svg+xml</code> — still live as of May 11). The archive contains two files: a 3 KB SUID-root helper (<code>systemd-exec</code>) and a 21 MB PyInstaller bundle (<code>pkg</code>). The helper is a minimal ELF that calls <code>setuid(0)</code>, <code>setgid(0)</code>, and <code>execvp()</code> — installed to <code>/usr/bin/systemd-exec</code> with <code>chmod 4755</code>. Persistence is created via <code>/etc/profile.d/systemd.sh</code>, which launches the payload masquerading as <code>/usr/libexec/upowerd</code>.We decrypted the PyArmor-protected Python bytecode from the Linux payload and confirmed it is the same bot source code as the Windows variant — identical RSA public key, DGA seeds, RC4 keys, C2 protocol, and DDR handler logic. The same campaign ID (<code>NdcHsJPM</code>) and all six DDR URLs are written to <code>~/.local/share/</code> as RC4-encrypted files (mirroring the Windows registry approach). The only difference is the Python runtime: the Linux bundle uses Python 3.12 (packaged via PyInstaller) versus Python 3.14 on Windows.The JDownloader developers restored clean downloads on May 9 and published a detailed incident timeline. Users who already had JDownloader installed and received updates through the application's built-in updater were not affected — only fresh downloads from the website during the compromise window were trojanized.If you ran the trojanized installer:<ul><li data-list-item-id="e78c8637f87f47adb2a6c0e9e37ff1466">The WDAC policy may have disabled your antivirus. Check <code>%WINDIR%\System32\CodeIntegrity\SIPolicy.p7b</code> — if it exists and you didn't create it, delete it and reboot.</li><li data-list-item-id="e5a9344602452a9e77dfe81e30c45fd8c">The registry keys <code>HKCU\SOFTWARE\Python</code> (bot config) and <code>HKLM\SOFTWARE\$77stager</code> (rootkit) are strong indicators of compromise — but if r77 is active, its API hooks hide all <code>$77</code>-prefixed registry keys and the bot's own hive from standard tools like <code>regedit</code>. To inspect these, boot from a Windows recovery environment or mount the registry hives offline.</li><li data-list-item-id="edcbc2f271c7b2885893f8f995fe252eb">A clean OS reinstall is the safest remediation. The r77 rootkit's reflective injection into <code>winlogon.exe</code> and AMSI bypass make partial cleanup unreliable.</li></ul>For defenders:<ul><li data-list-item-id="efcd7ce434d65f159da0dbff097d5fb44">The bot uses the default Python User-Agent <code>Python-urllib/3.14</code>. While not unique on its own, it can help correlate connections to the C2 URLs and DDR pages listed below.</li><li data-list-item-id="e35fe4757c01a79131defbd71e6762bfb">Monitor for DNS queries to the DGA pattern: 15-character lowercase alphanumeric hostnames on TLDs including <code>.top</code>, <code>.cfd</code>, <code>.sbs</code>, <code>.cyou</code>, <code>.icu</code>, <code>.casa</code>.</li><li data-list-item-id="e41ab2df0dd210b9e338012701bdf4398">The mutex name <code>Global\0C3C1D37</code> can serve as a host-based indicator.</li><li data-list-item-id="e68e99d7961368cd02568989f8e767d08">Block the dead-drop resolver pages: <code>telegra[.]ph/tr02-05-02</code>, <code>telegra[.]ph/ki06-05-02</code>, <code>rentry[.]co/zzk7opdu</code>, <code>rentry[.]org/wayc2qqz</code>.</li></ul><h2>&nbsp;</h2><h2>Indicators of Compromise</h2>Full IOC list available on <a href="https://github.com/avast/ioc">GitHub</a>.<h3>Hashes (SHA-256)</h3><table class="table"><thead><tr><th>Artifact</th><th>Hash</th></tr></thead><tbody><tr><td>Stage 1 — Windows (analyzed variant)</td><td><code>5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3</code></td></tr><tr><td>Stage 1 — Linux shell installer</td><td><code>6d975c05ef7a164707fa359284a31bfe0b1681fe0319819cb9e2c4eec2a1a8af</code></td></tr><tr><td>Stage 2 (C++ dropper)</td><td><code>77a60b5c443f011dc67ace877f5b2ad7773501f3d82481db7f4a5238cf895f80</code></td></tr><tr><td>Stage 3 — Windows (PyArmor bot)</td><td><code>5fdbee7aa7ba6a5026855a35a9fe075967341017d3cb932e736a12dd00ed590a</code></td></tr><tr><td>PyArmor runtime DLL</td><td><code>33318499489cdb82543c0bfea699b98f5928c7a360966df6e958a9cbc2eab3fe</code></td></tr><tr><td>r77 rootkit stager</td><td><code>5c887054cb1dce077943afa955db43306f66795f7cbda8233d8ba25230a23d41</code></td></tr><tr><td>WDAC CI policy</td><td><code>5ee86c177dc5bdba05e3bdc67b07115c66097f825fff257bf0d4a999bbb8a1ea</code></td></tr><tr><td>Linux payload archive (logo1.svg)</td><td><code>6550672cac21e036882921dd934ee06552dc74d3b0a9e1ddc26f952855e11371</code></td></tr><tr><td>Linux SUID helper (systemd-exec)</td><td><code>25744e90bfa44cbcbf1f3d3c3cb90dd79dd32a6e359df9d2660ff251d6d03b46</code></td></tr><tr><td>Linux PyInstaller bot (pkg)</td><td><code>bf47585bd0b39f0731f044b37a95eb7e311ad31b23b50306a113a3aa777dbfab</code></td></tr></tbody></table>Six additional Windows installer variants are listed in the <a href="https://jdownloader.org/incident_8.5.2026.html">official incident report</a>. Full hash list on <a href="https://github.com/avast/ioc/tree/master/JDownloaderRAT">GitHub</a>.<h3>Network indicators</h3><table class="table"><thead><tr><th>Type</th><th>Value</th><th>Context</th></tr></thead><tbody><tr><td>C2 URL</td><td><code>parkspringshotel[.]com/m/Lu6aeloo.php</code></td><td>Active C2</td></tr><tr><td>C2 URL</td><td><code>auraguest[.]lk/m/douV2quu.php</code></td><td>Active C2</td></tr><tr><td>Staging</td><td><code>checkinnhotels[.]com/img/logo1.svg</code></td><td>Linux payload (still live)</td></tr><tr><td>C2 IP</td><td><code>172.96.172[.]91</code></td><td>parkspringshotel.com</td></tr><tr><td>C2 IP</td><td><code>209.133.215[.]178</code></td><td>auraguest[.]lk</td></tr><tr><td>Staging IP</td><td><code>66.29.137[.]25</code></td><td>checkinnhotels.com</td></tr><tr><td>Dead-drop resolver</td><td><code>telegra[.]ph/tr02-05-02</code></td><td>Live, serves encrypted C2 list</td></tr><tr><td>Dead-drop resolver</td><td><code>rentry[.]co/zzk7opdu</code></td><td>Live, serves encrypted C2 list</td></tr><tr><td>Dead-drop resolver</td><td><code>telegra[.]ph/ki06-05-02</code></td><td>Stub, reserved for C2 rotation</td></tr><tr><td>Dead-drop resolver</td><td><code>rentry[.]org/wayc2qqz</code></td><td>Stub, reserved for C2 rotation</td></tr></tbody></table><h3>Host indicators</h3><table class="table"><thead><tr><th>Type</th><th>Value</th></tr></thead><tbody><tr><td>Mutex</td><td><code>Global\0C3C1D37</code></td></tr><tr><td>Registry (bot config)</td><td><code>HKCU\SOFTWARE\Python\*</code> (hex-encoded RC4-encrypted value names)</td></tr><tr><td>Registry (r77)</td><td><code>HKLM\SOFTWARE\$77stager</code>, <code>$77dll32</code>, <code>$77dll64</code>, <code>$77svc</code></td></tr><tr><td>WDAC policy</td><td><code>%WINDIR%\System32\CodeIntegrity\SIPolicy.p7b</code> (GUID <code>{31351756-3F24-4963-8380-4E7602335AAE}</code>)</td></tr><tr><td>Bot process</td><td><code>pythonw.exe</code> (Python 3.14, User-Agent <code>Python-urllib/3.14</code>)</td></tr><tr><td>Tor drop path</td><td><code>C:\ProgramData\tor\tor\tor.exe</code></td></tr><tr><td>Linux SUID binary</td><td><code>/usr/bin/systemd-exec</code></td></tr><tr><td>Linux payload</td><td><code>/root/.local/share/.pkg</code></td></tr><tr><td>Linux persistence</td><td><code>/etc/profile.d/systemd.sh</code></td></tr><tr><td>Linux masquerade</td><td><code>/usr/libexec/upowerd</code></td></tr></tbody></table><h3>MITRE ATT&amp;CK</h3><table class="table"><thead><tr><th>Technique</th><th>ID</th></tr></thead><tbody><tr><td>Supply Chain Compromise: Compromise Software Supply Chain</td><td>T1195.002</td></tr><tr><td>Obfuscated Files or Information</td><td>T1027</td></tr><tr><td>Impair Defenses: Disable or Modify Tools</td><td>T1562.001</td></tr><tr><td>Process Injection: Dynamic-link Library Injection</td><td>T1055.001</td></tr><tr><td>Web Service: Dead Drop Resolver</td><td>T1102.001</td></tr><tr><td>Dynamic Resolution: Domain Generation Algorithms</td><td>T1568.002</td></tr><tr><td>Encrypted Channel: Asymmetric Cryptography</td><td>T1573.002</td></tr><tr><td>Rootkit</td><td>T1014</td></tr><tr><td>Create or Modify System Process: Windows Service</td><td>T1543.003</td></tr><tr><td>Modify Registry</td><td>T1112</td></tr></tbody></table>For customers using Norton, Avast, AVG, Avira or any other security product, the most important question is whether the malicious installer was executed. If you downloaded an affected installer but did not run it, delete the file, download a fresh installer from the official JDownloader site, and run a full scan with up-to-date protection. If you ran the installer, or cannot rule out that you ran it, treat the system as compromised. JDownloader recommends a clean operating system reinstall in this situation, and we agree that this is the safest baseline. The Windows payload includes rootkit behavior, persistence, encrypted configuration and policy-based defense evasion, so a normal scan may reduce risk but cannot guarantee that every persistence mechanism has been removed. Until the system has been rebuilt or inspected from a trusted recovery environment, avoid using it for sensitive activity. Do not log in to email, banking, work accounts, password managers or other important services from that machine. Change important passwords from another trusted device, and monitor accounts for unusual activity.&nbsp;

Malware that hid itself on infected systems and disabled antivirus protection.

Inside the JDownloader Supply-Chain Attack: An r77 Rootkit Bot That Kills Your Antivirus

TLDR: Bedep was a malware family active mainly in 2014 and 2015 that used an unusually sophisticated domain generation algorithm, or DGA, to hide its command-and-control infrastructure. Instead of relying only on the date, it used real foreign exchange rates published by the European Central Bank, making its future domains much harder to predict in advance. Under the hood, the malware used ideas from group theory to generate a fixed set of unique domains without collisions, a rare example of advanced mathematics being applied directly in real-world malware.Most domain generation algorithms are boring. A linear congruential generator, a date seed, some modular arithmetic, a character table -- <code>seed = (seed * 0x41C64E6D + 0x3039) % 2^31</code>, rinse, repeat. You reverse them in an afternoon, pre-compute next month's domains over lunch, and move on.Bedep author implemented a number theory textbook inside a 32-bit DLL, and the result is one of the most mathematically elegant pieces of malware ever shipped.This post is a deep dive into this unique engineering.<h2>What is Bedep?</h2>Bedep is an ad-fraud botnet that was active from late 2014 through 2015, delivered exclusively through the Angler exploit kit. When a Flash zero-day (CVE-2015-0311) was burning, Angler was dropping Bedep. The malware itself was a modular downloader focused on click fraud, but its infrastructure is what made it interesting. In early 2015, new variants appeared with a DGA for C2 resolution. A three-day sinkhole by Arbor Networks (ASERT) caught phone-homes from roughly 82,000 unique IPs, spread across every continent except -- notably -- Russia.Dennis Schwarz originally reversed the DGA at ASERT, who published a proof-of-concept Python reimplementation and a detailed write-up titled "Bedep's DGA: Trading Foreign Exchange for Malware Domains." The original blog post has since been taken down from NETSCOUT's site, but survives on the <a href="https://web.archive.org/web/20160311083109/http://www.arbornetworks.com:80/blog/asert/bedeps-dga-trading-foreign-exchange-for-malware-domains/">Wayback Machine</a>. The PoC lived at <code>github.com/arbor/bedep_dga</code>. Dennis got the algorithm working but noted that parts of it were opaque -- he called the core transform a "blackbox" and flagged the embedded table as "likely something Fermat number related." He was right. Let's open that box.&nbsp;<h2>The ECB trick: Seeding a DGA from the financial markets</h2>Before the math starts, Bedep needs a seed that both the bot and the botmaster can independently derive without communicating. Most DGAs use the date. Bedep uses the date and the global foreign exchange market.The algorithm fetches two XML files from legitimate public services:<ol><li data-list-item-id="ec5890edf5187711796f804fae7ad8577">UTC time from <code>earthtools.org/timezone/0/0</code> -- the current timestamp, converted to "days since year zero."</li><li data-list-item-id="ead6313dc967de96442575ff50339b412">Euro foreign exchange reference rates from <code>www.ecb.europa.eu/stats/eurofxref/eurofxref-hist-90d.xml</code> -- the European Central Bank's daily publication of EUR conversion rates against 31+ world currencies, updated every business day.</li></ol>The time is used to select which day's rates to use. Specifically, Bedep picks "last Tuesday's" exchange rates -- meaning the preceding week's Tuesday until Thursday, after which it rolls forward to the current week's Tuesday. Only rates falling on a Monday boundary (in the algorithm's day-counting scheme) are considered. This gives a roughly weekly rotation with a deterministic selection rule.From the chosen date, Bedep extracts up to 48 currency rates -- USD, JPY, GBP, CZK, BGN, HUF, and so on. Each rate is parsed through a slightly broken custom <code>atof()</code> implementation (off by a bit in the least significant digits -- a quirk, not a feature), packed into a 64-bit IEEE double, and its low 32-bit dword is extracted for use in the algorithm.Here is what a single run looks like, from the PoC output for April 7, 2015:<code>parsed 31 currencies from 2015-04-07 (currency date): &nbsp; &nbsp;USD: 1.0847 &nbsp; &nbsp; &nbsp;JPY: 130.33 &nbsp; &nbsp; BGN: 1.9558 &nbsp; &nbsp;CZK: 27.455 &nbsp; &nbsp; &nbsp;DKK: 7.4714 &nbsp; &nbsp;GBP: 0.7286 &nbsp; &nbsp;HUF: 299.08 &nbsp; &nbsp; &nbsp;PLN: 4.0578 &nbsp; &nbsp;RON: 4.4165 &nbsp; &nbsp;SEK: 9.374 &nbsp; &nbsp; &nbsp; CHF: 1.0438 &nbsp; &nbsp;NOK: 8.73 &nbsp; &nbsp;HRK: 7.619 &nbsp; &nbsp; &nbsp; RUB: 59.8265 &nbsp; TRY: 2.8079 &nbsp; &nbsp;AUD: 1.4192 &nbsp; &nbsp; &nbsp;BRL: 3.3979 &nbsp; &nbsp;CAD: 1.3563 &nbsp; &nbsp;CNY: 6.7241 &nbsp; &nbsp; &nbsp;HKD: 8.4086 &nbsp; &nbsp;IDR: 14091.77 &nbsp; &nbsp;ILS: 4.267 &nbsp; &nbsp; &nbsp; INR: 67.598 &nbsp; &nbsp;KRW: 1183.28 &nbsp; &nbsp;MXN: 16.1919 &nbsp; &nbsp; MYR: 3.9527 &nbsp; &nbsp;NZD: 1.4423 &nbsp; &nbsp;PHP: 48.3 &nbsp; &nbsp; &nbsp; &nbsp;SGD: 1.4724 &nbsp; &nbsp;THB: 35.335 &nbsp; &nbsp;ZAR: 12.8345</code>&nbsp;

Why is this clever? Because the ECB rates are:<ul><li data-list-item-id="e5f3c952abb440c715bcfa626ac9bd4c0">Publicly available -- anyone can fetch the same XML</li><li data-list-item-id="e7730a0d72c71be00a0c3d3feebc10618">Globally consistent -- every bot on every continent gets the same data</li><li data-list-item-id="e1667d4c4edd48ffbda05118e24153bf0">Unpredictable in advance -- nobody can predict next Tuesday's EUR/USD rate</li><li data-list-item-id="e80b9125dab13aae37cb9ed8b88656475">Historically verifiable -- the ECB publishes archives going back years</li><li data-list-item-id="e0d9bf0abba3c6cb7703705ce6203f707">Impossible to tamper with -- the ECB is not going to modify their reference rates to help you sinkhole a botnet</li></ul>And because the malware fetches this from <code>ecb.europa.eu</code>, the request looks like legitimate traffic. A Snort signature (SID 33188) was written to detect it, but it fired constantly on real users checking exchange rates.<h2>The mathematical core</h2>This is where Bedep stops being a clever botnet and starts being a discrete mathematics exercise.<h3>Precomputed subgroup parameters</h3>The DLL embeds a lookup table -- 102 entries of 8 dwords each, stored as JSON in the PoC (<code>transform2_table_varN.json</code>, one per config variant). At first glance it looks like random constants. It is not.The <code>transform2</code> function takes a hash derived from the exchange rates and days-since value, then uses it as an index into this table. Each table entry, after being decoded through config-specific XOR and multiply constants (<code>0x663d81 * entry[0] ^ value3</code> and <code>0x281 * entry[1] ^ value2</code>), yields two critical values:<ul><li data-list-item-id="ee4084ac1a9ee922a9a2585119d02acb9">p -- a prime number</li><li data-list-item-id="e7d298adce011a8fe31f7d5db7f1685ee">q -- an integer such that q divides p - 1</li></ul>This is the subgroup structure. The table stores primes whose group orders (p - 1) have known factorizations with small prime factors. The malware doesn't need to factor p - 1 at runtime -- that hard work was done offline by the author and baked into the DLL. Dennis Schwarz noted these were "likely something Fermat number related," and he was onto something: the primes are chosen so that their totient has a smooth factorization, making generator-finding tractable.The number of domains to generate comes directly from q - 1. For the first config, this works out to 22 domains; for the second, 28 -- totaling 50 domains per weekly rotation.<h3>Finding generators: A textbook primitive root search</h3>With p and the prime factorization of p - 1 in hand, Bedep needs a generator of the multiplicative group ((\mathbb{Z}/p\mathbb{Z})^*) -- or more precisely, of a specific subgroup of order q.The <code>transform8</code> function does this in two stages. First, it runs a trial-division prime sieve: starting from 3, stepping by 2 (skipping evens), it tests each candidate against all previously found primes. It collects up to 37 small primes, then filters for those that actually divide q (the subgroup order). This gives the prime factorization of q.Then <code>transform3</code> finds the primitive root itself. This is the standard algorithm straight from a number theory textbook:<code>def find_primitive_root(p, prime_factors_of_order): &nbsp; &nbsp;for g in range(2, p // 2): &nbsp; &nbsp; &nbsp; &nbsp;is_generator = True &nbsp; &nbsp; &nbsp; &nbsp;for q_i in prime_factors_of_order: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# If g^((p-1)/q_i) ≡ 1 (mod p), then g generates &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# a proper subgroup, not the full group. Reject it. &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if pow(g, (p - 1) // q_i, p) == 1: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;is_generator = False &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;break &nbsp; &nbsp; &nbsp; &nbsp;if is_generator: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;return g &nbsp; &nbsp;return None</code>

The actual code in <code>transform3</code> is this logic rendered in C-style loop structure with manual index tracking, but the mathematics is identical. For each candidate g starting from 2, it checks:[ g^{(p-1)/q_i} \not\equiv 1 \pmod{p} \quad \text{for all prime factors } q_i \text{ of } p-1 ]If g passes all checks, it generates the full group. This is literally the algorithm from Section 11.1 of Shoup's A Computational Introduction to Number Theory and Algebra, implemented in a malware DLL.<h3>Walking the cyclic group</h3>Now comes the payoff. With a prime p, a generator g, and a subgroup order q, the <code>transform7</code> function sets up the DGA's iteration state:<code>modulus &nbsp; &nbsp;= p &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# field_c seed &nbsp; &nbsp; &nbsp; = pow(g, random_e, p) &nbsp; &nbsp; &nbsp; &nbsp;# field_4 -- starting element step &nbsp; &nbsp; &nbsp; = pow(g2, random_f, q) &nbsp; &nbsp; &nbsp; # field_8 -- step exponent</code>

The starting position <code>seed</code> is g raised to a random exponent (derived from <code>rdtsc</code>, the CPU timestamp counter). The step is similarly randomized from a second generator. Both are computed via modular exponentiation.Then, for each domain, the iteration is simply:<code>seed = pow(seed, step, modulus) &nbsp; &nbsp; # one step through the cyclic group domain = seed_to_domain(seed, currencies)</code>

That single line -- <code>pow(seed, step, modulus)</code> -- is the entire DGA engine. Each call advances the state to the next element of the cyclic subgroup.Because the subgroup has order q, and step is coprime to q (guaranteed by the generator construction), this walk visits every non-identity element of the subgroup exactly once before cycling. The number of domains generated equals q - 1, which is precisely the number of non-identity elements. No collisions. No wasted iterations. No off-by-one hoping you hit enough domains.The key insight: the set of group elements visited is deterministic (fixed by p, g, and the exchange rates), but the order of visitation depends on the random exponents from <code>rdtsc</code>. Every infected machine walks through the same set of q - 1 elements, generating the same q - 1 domain names, but potentially in a different order. Same destinations, different paths.<code>flowchart TB &nbsp; &nbsp;subgraph cyclic_group ["Cyclic Subgroup of (Z/pZ)*"] &nbsp; &nbsp; &nbsp; &nbsp;E1["g^1 mod p"] --&gt; E2["g^2 mod p"] &nbsp; &nbsp; &nbsp; &nbsp;E2 --&gt; E3["g^3 mod p"] &nbsp; &nbsp; &nbsp; &nbsp;E3 --&gt; E4["..."] &nbsp; &nbsp; &nbsp; &nbsp;E4 --&gt; Eq["g^(q-1) mod p"] &nbsp; &nbsp; &nbsp; &nbsp;Eq --&gt; E1 &nbsp; &nbsp;end &nbsp; &nbsp;subgraph walk ["DGA Walk (order depends on rdtsc)"] &nbsp; &nbsp; &nbsp; &nbsp;S1["seed_0"] --&gt;|"pow(s, step, p)"| S2["seed_1"] &nbsp; &nbsp; &nbsp; &nbsp;S2 --&gt;|"pow(s, step, p)"| S3["seed_2"] &nbsp; &nbsp; &nbsp; &nbsp;S3 --&gt;|"pow(s, step, p)"| S4["..."] &nbsp; &nbsp; &nbsp; &nbsp;S4 --&gt;|"pow(s, step, p)"| SN["seed_(q-2)"] &nbsp; &nbsp;end &nbsp; &nbsp;S1 -.-&gt;|"= g^e mod p\n(random start)"| cyclic_group &nbsp; &nbsp;S2 -.-&gt;|maps to| E3 &nbsp; &nbsp;S3 -.-&gt;|maps to| Eq</code>

<h2>From Group Elements to Domain Names</h2>Each group element is a 32-bit integer. Turning it into a domain name is the final step, handled by <code>transform11</code>. This is less mathematically elegant and more of a traditional mixing function, but it has a nice property: every character position in the domain uses a different currency rate.The algorithm cycles through the full list of parsed currencies (31 in the example above). For a domain of length 18, that means character 0 is influenced by USD, character 1 by HRK, character 2 by MXN, character 3 by GBP, and so on. Each character is computed by:<ol><li data-list-item-id="e1b4d60fdb8fc1f153baf8a99855a0b35">Multiplying the currency's 3-letter name (packed as a 32-bit int) and its 64-bit floating-point rate by large constants</li><li data-list-item-id="ec05b47f97cd63ed0295b790fd5474c85">XORing and shifting the result with the current seed and the days-since value</li><li data-list-item-id="e2f1e2c5d769b5e8978ca12f1d05cf791">Taking the result modulo 26 (for positions 2+) or modulo 36 (for the last two positions, allowing digits)</li><li data-list-item-id="e589b38ae5aa632fba755388fc26bd71c">Adding the ASCII offset for 'a'</li></ol>The domain length itself is derived from the seed XORed with a rate-dependent value, bounded between 12 and 18 characters. All domains use the <code>.com</code> TLD.A trace from the PoC output shows the mixing in action:<code>seed: 0xa13c9652 &nbsp; &nbsp;mixing in USD's rate &nbsp; &nbsp;mixing in HRK's rate &nbsp; &nbsp;mixing in MXN's rate &nbsp; &nbsp;mixing in GBP's rate &nbsp; &nbsp;... &nbsp; &nbsp;mixing in ZAR's rate &nbsp; &nbsp;domain: rrpohktjlscncqxvt3.com seed: 0x558af439 &nbsp; &nbsp;mixing in USD's rate &nbsp; &nbsp;... &nbsp; &nbsp;domain: wjavcjhazzxyxotkbi.com</code>

Each domain is a fingerprint of the entire exchange rate vector, filtered through one specific element of the cyclic group.<h2>The Full Pipeline</h2>Putting it all together:<code>flowchart LR &nbsp; &nbsp;ECB["ECB XML\n31+ currency rates"] --&gt; DateSelect["Select last\nTuesday's rates"] &nbsp; &nbsp;Earth["earthtools.org\nUTC timestamp"] --&gt; DateSelect &nbsp; &nbsp;DateSelect --&gt; Mix["XOR/multiply\nrates + days_since"] &nbsp; &nbsp;Mix --&gt; TableLookup["Lookup table\n→ prime p, order q"] &nbsp; &nbsp;TableLookup --&gt; GenFind["Sieve primes,\nfind generator g"] &nbsp; &nbsp;GenFind --&gt; GroupSetup["seed = g^rand mod p\nstep = g2^rand mod q"] &nbsp; &nbsp;GroupSetup --&gt; Walk["Iterate:\nseed = seed^step mod p"] &nbsp; &nbsp;Walk --&gt; CharMix["Mix seed with\ncurrency rates"] &nbsp; &nbsp;CharMix --&gt; Domains["22-28 domains\nper config"]</code>

Seven configs were observed in the wild, each with its own embedded table, XOR constants, and currency count (36 or 48). Each malware variant embedded two configs that ran per rotation -- the first generating 22 domains, the second 28, yielding 50 domains total. Across the observed campaign, domains were registered 2-5 days ahead of use through "Domain Context" registrar with Regway nameservers, all resolving to infrastructure at 5.196.181.244 and 46.105.251.1.<h2>Why this matters</h2>Compare Bedep's approach with its contemporaries:<table class="table"><thead><tr><th>Family</th><th>DGA Technique</th><th>Seed</th></tr></thead><tbody><tr><td>Conficker.C</td><td>Date + simple arithmetic</td><td>Current date</td></tr><tr><td>Gamaredon</td><td>Nested character-range loops</td><td>Hardcoded ranges</td></tr><tr><td>Necurs</td><td>CRC32 hash of date components</td><td>Date + constant</td></tr><tr><td>Matsnu</td><td>Dictionary word concatenation</td><td>Days since epoch</td></tr><tr><td>Bedep</td><td>Cyclic group walk mod p</td><td>ECB exchange rates</td></tr></tbody></table>Every other DGA on this list can be pre-computed arbitrarily far into the future. Bedep cannot -- because Tuesday's exchange rates don't exist until Tuesday. You can sinkhole Conficker's domains for next year during your coffee break. For Bedep, you have to wait for the ECB to publish, then race the botmaster to register the domains.The mathematical guarantee is real: the cyclic group structure ensures exactly q - 1 distinct domains per rotation with no collisions and no wasted iterations. The primitive root construction ensures the generator produces every element. The precomputed tables avoid expensive factorization at runtime. The exchange rate seed provides unpredictable entropy from a trusted, globally-consistent, publicly-verifiable source.This is not someone who copy-pasted a DGA from a forum. The author understood multiplicative groups modulo primes, knew how to find primitive roots, precomputed smooth-order primes offline, and wired the whole thing to the European Central Bank's daily publications. Whether they learned this from a university course, a textbook, or a cryptography library's source code, the result is unmistakable: this is applied algebra, deployed in production, at scale.The original ASERT analysis is preserved on the <a href="https://web.archive.org/web/20160311083109/http://www.arbornetworks.com:80/blog/asert/bedeps-dga-trading-foreign-exchange-for-malware-domains/">Wayback Machine</a>. The proof-of-concept implementation was published on <a href="https://github.com/arbor/bedep_dga">ASERT's GitHub</a>. The sample analyzed here is <code>e5e72baff4fab6ea6a1fcac467dc4351</code> (MD5) /&nbsp;<code>d0fb1b66b6e4da395892327be9f39adb4533e7759ace39f67bdde0bb1cdaef35</code> (SHA256).&nbsp;Credits: The DGA was originally reversed by Dennis Schwarz at Arbor Networks / ASERT. This post builds on his work, focusing on the mathematical structure he identified but didn't fully unpack.

A closer look at how Bedep used foreign exchange data and advanced math to generate hard-to-predict domains, making its command-and-control infrastructure more difficult for defenders to block and disrupt

When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA

A VM-obfuscated backdoor observed on a single machine in the UK, operated for one year, and vanished without a trace. 

Chasing an Angry Spark

<h2>TL;DR&nbsp;</h2>It started with a lie. A sample walked into the lab wearing a Vidar label like a cheap suit two sizes too small. We pulled the threads, and the whole thing came apart. What fell out was a previously unknown information stealer we named Torg Grabber – 334 samples compiled over three months, a rapid evolution from Telegram dead drops through an encrypted TCP protocol nobody asked for, all the way to a production-grade REST API that worked like a Swiss watch dipped in poison. Over 40 operator tags pulled from the binaries – a mix of nicknames, date-encoded batch IDs, and confirmed Telegram user IDs – fingerprinted individual MaaS customers and confirmed what we already suspected: this was a builder-and-panel operation, crime as a service, infrastructure included. OSINT resolution of the numeric tags peeled back the curtain on eight operators as Telegram accounts buried up to their necks in the Russian cybercrime ecosystem. The bot tokens gave us the developer accounts behind the whole show. Nobody said crime doesn’t pay, but nobody said it doesn’t leave fingerprints either.&nbsp;The misclassification that started It all&nbsp;The sample came in on a Tuesday in early February, wearing the name Vidar Stealer the way a pickpocket wears a priest’s collar. It didn’t fit. A 747 KB PE64 binary compiled with MinGW/GCC – when Vidar v17.9 is a 32-bit MSVC job that, as a colleague put it, “looks significantly different.” That was like saying a Great Dane looks significantly different from a Pekingese. You didn’t need a magnifying glass.&nbsp;A deeper look turned up a self-identifying debug string – "<code>grabber v1.0</code>" – sitting in the binary like a monogrammed handkerchief left at a crime scene. The C2 protocol was all wrong for Vidar: REST API endpoints (/api/auth, /api/upload/chunk), ChaCha20 encryption, HMAC-SHA256 authentication. This wasn’t Vidar any more than I was the Queen of England.&nbsp;We ran it against StealC v2 for good measure – similar endpoint patterns on the surface, the way all gin joints look alike from the sidewalk. Zero protocol overlap. Different endpoint structure, different communication model, different encryption. This was something new, something nobody had put a name to yet.&nbsp;So we named it ourselves. Torg Grabber – “Torg” from its most-used C2 domain <code>technologytorg.com</code> (Russian “торг” = trade, marketplace – fitting for a business that trades in other people’s secrets), and “Grabber” from the malware’s own vocabulary (<code>GRABBER_HOST, GRABBER_TAG, "grabber v1.0</code>"). If a thing names itself, you ought to listen.&nbsp;<h2>Timeline: Two months of rapid development&nbsp;</h2>Three hundred thirty-four samples. Three months. It was like watching a time-lapse film of a weed growing through concrete. The corpus told the story of a malware operation spinning up in real time, stumbling forward with the reckless confidence of a man who knows exactly what he’s doing and doesn’t much care who’s watching.&nbsp;

Three exfiltration mechanisms. Three ways to get the goods out. Each one a little smarter than the last, the way a burglar graduates from smashing windows to picking locks to making copies of the key.<h3>Phase 1: Telegram Bot API (Dec 9–11, 2025)</h3>The earliest builds were small and nervous, the way a rookie’s hands shake on his first job. Compact little things, 270 to 313 KB, that grabbed credentials, stuffed them into a ZIP archive, and shipped the whole package to a private Telegram channel via&nbsp;sendDocument. No encryption beyond TLS. A&nbsp;User-Agent: TG header about as subtle as a neon sign in a funeral parlor. Five retry attempts, and if the ZIP upload choked, a fallback to plaintext&nbsp;sendMessage – the digital equivalent of shouting your secrets across a crowded room.Twenty-five samples, eight bot tokens, eight private channels, each with two or three members. This was the prototype phase: fast to set up, zero infrastructure cost, and about as durable as a paper umbrella in a monsoon. Telegram can revoke tokens on a whim, and the API calls stick out in traffic logs like a tall man in a short crowd.<h3>Phase 2: GRAB Binary TCP Protocol (Dec 17–20, 2025)</h3>Four samples. A narrow four-day window. This was the experimental phase – somebody had an idea, and they were going to see if it could walk before they taught it to run.Instead of HTTP, the malware opened a raw TCP socket to&nbsp;<code>*.tara.net.bd</code> on port 50443 and spoke a custom binary protocol that had all the charm of a coded knock on a speakeasy door:<ul><li data-list-item-id="e3d01df3606010b531fb2e83821bb7f96">A 9-byte frame: 4-byte&nbsp;<code>GRAB</code> magic, 1-byte type, 4-byte length</li><li data-list-item-id="e0aa34faadca69a4d6fcee2220c2a3415">ChaCha20-Poly1305 AEAD encryption with HMAC-SHA256 key derivation</li><li data-list-item-id="eec12b3e52f329ead2daead35c83d690c">SHA-256 hash of the payload sent before the encrypted data</li><li data-list-item-id="e0500a32b5824c04717745665cb222a44">64 KB chunks with 5-second retry intervals</li></ul>The C2 hostnames were&nbsp;<code>bk.tara.net.bd and&nbsp;raketa.tara.net.bd</code> – “raketa” being Russian for “rocket,” because even criminals have a sense of poetry. Both under a Bangladesh TLD but geolocated to Turkey, which made about as much geographic sense as a polar bear in Havana. The encryption key was hardcoded:&nbsp;<code>0123456789abcdef</code> repeated. A test key. Development builds, still warm from the compiler.See Appendix A, Figure A1Technically sophisticated – proper AEAD, authenticated handshakes, chunked transfer. The kind of work that said the developer knew cryptography the way a safecracker knows tumblers. But it was abandoned after four builds. Running a custom TCP protocol at scale turned out to be harder than hiding behind Cloudflare, which is to say, harder than letting somebody else do the heavy lifting. Some lessons you only need to learn once.<h3>Phase 3: REST API over HTTPS (Dec 18 onward)</h3>This was the production rig. The real thing. No more rehearsals.The malware performs a JSON registration at&nbsp;<code>/api/auth</code>, sending along a machine fingerprint – GPU, wallpaper hash, hardware ID, antivirus product – like a new inmate checking into prison with his personal effects. In return, it gets configuration, a session token, and sometimes shellcode, because some operators like to bring their own party favors. Then comes the upload: stolen data, chunked over HTTPS, ChaCha20-encrypted, routed through Cloudflare. Each request carries an HMAC-SHA256&nbsp;<code>X-Auth-Token</code> header, because even thieves want to know they’re talking to the right fence.See Appendix A, Figure A2Over two months, the binary fattened up from ~410 KB to ~747 KB, the way a confidence man’s wallet thickens over a good season. The additions were considerable: a 20 KB ChaCha20-encrypted Reflective DLL for bypassing Chrome 127+ App-Bound Encryption across 7 Chromium browsers via their IElevator COM interfaces; 20 direct NT syscall wrappers with PRNG-obfuscated tables; and an ever-growing shopping list of collection targets – 850 browser extensions alone consuming ~213 KB of binary space, like a burglar’s toolkit that takes up half the trunk. Two size epochs are visible – a ~160 KB jump around January 21 that marks a major feature release as clearly as a new coat of paint on an old building. The newest builds kept rolling off the line daily through February 2026, each one a little bigger, a little meaner, a little hungrier.<h2>The loader chain: From dropper to stealer</h2>Torg Grabber doesn’t show up at the party alone. It arrives wrapped in layers, the way a bad idea shows up wrapped in good intentions — three skins of encryption and obfuscation to peel away before the stealer ever touches memory. Each skin has a job. The outer one: crypter-level polymorphism, the kind that makes every sample look like a different animal. The middle: reflective PE loading, never leaving fingerprints on disk. The innermost: the stealer itself, finally naked and ready to work.<h3>Stage 0: The Dropper</h3>The outermost layer changes its face depending on who’s handing it out. Telemetry from our userbase paints the picture – several lure families, all funneling into the same loader chain like tributaries feeding a dirty river:<ul><li data-list-item-id="ef20558cd69ad2240467faf8b907f23c7">Fake game cheats:&nbsp;<code>CrimsonLoader.exe,&nbsp;RivalMods.exe</code></li><li data-list-item-id="ecfc5a9772478bacf10752d88d8626f41">Cracked software:&nbsp;R<code>elease-app-x64.rar</code> →&nbsp;<code>Set-up.exe</code>,&nbsp;<code>Aerovora.zip</code>,&nbsp;<code>Terraria_1.4.5.zip</code></li><li data-list-item-id="eb92e8d896c8fe97501e98a43c55aa26a">ClickFix clipboard: PowerShell one-liner via Google Apps Script (see&nbsp;<a href="//F7CA28BA-0D78-43F6-82F3-AD55EE8C3098#in-the-wild-observed-infection-chain">full chain below</a>)</li></ul>Regardless of the lure, the final dropper drops a randomly-named executable into&nbsp;<code>C:\Windows\ –&nbsp;v4jkqh.exe</code>,&nbsp;<code>hkjpy08.exe</code>,&nbsp;<code>ln3dkgz.exe</code>,&nbsp;<code>en3v4ior.exe</code> – names that look like someone fell asleep on the keyboard. This pattern is consistent across 78 distinct samples in our telemetry. The crypter stage. The thing that gets you in the door.Before it spawns the next stage, the dropper does something clever. Configuration propagation. It sets environment variables that carry the operator’s whole setup across process boundaries — the way a con man memorizes his cover story before he walks into the bank:

One compiled stealer, a hundred operators. The dropper injects identity at runtime. Crime as a service, served by environment variables.<h3>Stage 1: Self-Extracting Loader</h3>The first code stage is a MinGW-compiled PE64 with an encrypted overlay pasted on the end — beyond the section data, like a secret message written on the back of a photograph. The overlay structure lives in the file’s last 8 bytes. You have to read backwards to find the beginning:See Appendix B, Listing B1&nbsp;The extraction pipeline runs like a three-card monte:<ol><li data-list-item-id="e5b92ce18abe492c50ce87bded031e432">Hex decode — Custom hex encoding: 3 bytes per output byte, two hex digits plus a separator. Lower entropy than raw ciphertext. The kind of detail that evades entropy detection the way a whisper evades a crowded room.</li><li data-list-item-id="eea648425fcc7b67250a494bd3dc405ea">AES-256-CBC decrypt — Key and IV pulled from the overlay. Every build gets its own key material. The builder doesn’t recycle.</li><li data-list-item-id="e472ee13b2b0ba690024aa2694c9aaf77">Parse decrypted buffer — A&nbsp;uint32 skip count, then null-terminated API name strings (<code>NtWriteVirtualMemory</code>, <code>NtProtectVirtualMemor</code>y), then the shellcode. The loader resolves those NT APIs at runtime and injects the shellcode into memory using direct syscalls. No imports. Clean hands.</li></ol><h3>Stage 2: Reflective PE Loader</h3>The shellcode from Stage 1 is a PE in disguise. A reflective loader carrying the final Torg Grabber payload as an encrypted blob in <code>.rdata</code> — about 793 KB of trouble. This stage runs entirely in memory. It never touches disk. The kind of ghost that leaves no footprints.<h4>Dynamic API Resolution</h4>The loader finds every Windows API it needs by walking the PEB — Process Environment Block — and parsing export tables. No&nbsp;<code>GetProcAddress</code> in the import table. Static analysis looks at the binary and sees nothing. It’s the malware equivalent of paying cash.<h4>AES-256-CBC Decryption</h4>The blob gets decrypted first. AES-256-CBC, hardcoded 256-bit key, 128-bit IV. Each build carries different constants. Fingerprints:See Appendix B, Listing B2&nbsp;<h4>Four Cascaded Byte Transforms</h4>After AES comes the garnish. Four byte-level transforms in sequence. Reversible arithmetic over GF(2^8). The constants vary by build; the structure never does:

<table class="table"><tbody><tr><td>Step</td><td>Operation</td><td>Constant</td><td>Purpose</td></tr><tr><td>1</td><td>byte = (byte + K₁) &amp; 0xFF</td><td>0x7C / 0xAC</td><td>Additive shift</td></tr><tr><td>2</td><td>byte = byte ^ K₂</td><td>0x68 / 0x58</td><td>XOR mask</td></tr><tr><td>3</td><td>byte = ROR(byte, 2) / ROL(byte, 2)</td><td>2 bits</td><td>Bit rotation</td></tr><tr><td>4</td><td>byte = (byte * K₃) &amp; 0xFF</td><td>0xC5 / 0xCD</td><td>Modular multiply</td></tr></tbody></table>

Five layers total with AES. Simple XOR-key recovery goes home empty. Automated decryption without the right constants hits a wall.<h4>Anti-Analysis: NOP-Equivalent Functions</h4>Between decryption stages, the loader calls functions that look busy. Multi-register shuffles. Conditional branches. Memory loads. Complex enough to make a decompiler sweat. Net effect: zero. They’re NOPs dressed up for the opera:

Several of these stubs get called between each decryption stage and before the memmove. Dead code padding the call graph like sawdust in a cheap sausage.<h4>The Hidden memmove: PE Reassembly from Non-Contiguous Chunks</h4>The operation that matters most — and the one you’re most likely to miss. After the byte transforms, a single&nbsp;<code>memmove</code> stitches the final PE together from two pieces that weren’t sitting next to each other:See Appendix B, Listing B3Skip the memmove and you get a PE with a poisoned&nbsp;<code>.idata</code> section and 110 KB of overlay garbage. It loads into IDA. It crashes when you run it. The encryption stuffed junk between the two halves — any automated extractor has to know exactly where to cut and paste. Final size:&nbsp;<code>0xA6E00</code> = 683,520 bytes. Hardcoded in the loader as a&nbsp;<code>VirtualAlloc</code> parameter.<h4>Manual PE Mapping</h4>After reassembly, the loader maps the PE the old-fashioned way. Reflective loading 101:<ol><li data-list-item-id="e1b056298a8894ae089d3da9a8901b3aa">Allocate —&nbsp;<code>VirtualAlloc(PAGE_READWRITE)</code> for&nbsp;<code>SizeOfImage</code> bytes</li><li data-list-item-id="eb2193d53562357b767ce7b7fa01d3116">Copy headers — first&nbsp;<code>SizeOfHeaders</code> bytes</li><li data-list-item-id="eef41778348fbeeefd913c08313ff305b">Map sections — to their virtual addresses (<code>VirtualAddress + base</code>)</li><li data-list-item-id="e2dfba01eaa5a533e27b2001492ba03c6">Process relocations — apply delta from preferred&nbsp;<code>ImageBase</code> to actual allocation</li><li data-list-item-id="e84e05b522b4a583feeb4671f81391808">Resolve imports — walk the Import Directory,&nbsp;<code>LoadLibraryA</code> and&nbsp;<code>GetProcAddress</code> for each DLL/function</li><li data-list-item-id="e0bd9f61592132d5e5cd730bf4b857dff">Set section permissions —&nbsp;<code>VirtualProtect</code> with&nbsp;<code>PAGE_EXECUTE_READ</code>,&nbsp;<code>PAGE_READONLY</code>,&nbsp;<code>PAGE_READWRITE</code></li><li data-list-item-id="e34ebad8f173a493e0d3668315a6921b1">Call entry point —&nbsp;<code>AddressOfEntryPoint + base</code></li></ol>The stealer PE never hits disk. It lives only in memory, mapped inside the loader’s process. A ghost inside a ghost.<h3>Stage 3: Torg Grabber</h3>The final payload. 683 KB PE64. MinGW/GCC. Seven hundred thirty-seven functions in fifteen categories, organized like a filing cabinet in a detective’s office — everything in its place:See Appendix B, Listing B4 (Stage 3: Torg Grabber).]Execution starts at&nbsp;<code>main_data_collection_and_exfil</code>. The orchestrator. The one running the show:<ol start="8"><li data-list-item-id="e7e97057020ca972f16d99cd2de4c9d58">Reads configuration —&nbsp;<code>GRABBER_*</code> environment variables, set by the dropper, with hardcoded fallbacks for the forgetful</li><li data-list-item-id="e59d21024124feb483ed7084b75283ebe">Profiles the system — MachineGuid, GPU, process list, antivirus (46 signatures across 24 products), VM/sandbox detection, CIS locale check</li><li data-list-item-id="e6dd228fde01ef32dd9634540729fde71">Creates a mutex —&nbsp;<code>Local\&lt;MachineGuid&gt;</code> so only one instance runs at a time</li><li data-list-item-id="e003a12fb4575621eb9150a6dd12e7f56">Registers with C2 — POST to&nbsp;<code>/api/auth</code> with ChaCha20-encrypted JSON, gets a session ID and maybe streaming config</li><li data-list-item-id="e8caea529cba09bd0a405a330b9f1500e">Resolves NT syscalls — parses&nbsp;<code>ntdll.dll exports</code>, builds PRNG-obfuscated syscall table</li><li data-list-item-id="e30e1ff27be21c754814b9cbad9b3f89e">Collects data — 25 Chromium browsers, 8 Firefox, 850 extensions, Discord, Steam, Telegram, VPN, FTP, email, password managers, wallets, screenshot, installed software, Desktop/Documents files</li><li data-list-item-id="ee0c091fe9e7fafc3479d6316df833505">Exfiltrates — archives to in-memory ZIP or streams chunks, uploads via chunked HTTPS with ChaCha20 and HMAC-SHA256</li></ol>The stealer can also take shellcode from the C2 at registration.&nbsp;<code>decrypt_and_execute_shellcode</code> handles ChaCha20-decrypted, zlib-compressed payloads — allocates executable memory via&nbsp;<code>NtAllocateVirtualMemory</code>, runs it. Arbitrary post-exploitation without a new binary. Before execution,&nbsp;<code>export_config_to_env</code> writes the config back to environment variables so any child process inherits the operator’s settings.<h3>Configuration propagation: The environment variable chain</h3>One pattern runs through the whole chain: configuration travels by environment variable. The dropper sets&nbsp;<code>GRABBER_*</code>. The stealer reads it at startup (<code>init_grabber_config_from_env</code>). Before process injection — ABE bypass, shellcode — the stealer writes the config back to env vars (<code>export_config_to_env</code>). Child processes inherit. No recompilation. One payload, many operators:See Appendix B, Listing B5&nbsp;The stealer binary is operator-agnostic. The builder customizes the dropper. The dropper does the rest.<h3>In the Wild: Observed infection chain</h3>Static analysis gives you the stages. Behavioral telemetry gives you the story. We captured the full delivery chain on a real victim machine — January 30, 2026 — from initial social engineering through PowerShell stages to stealer execution. The whole show, start to finish.<h4>The ClickFix Initial Access</h4>Before the InnoSetup dropper. Before the PowerShell. A clipboard hijack. The victim hits a malicious Google Apps Script page:<code>https://n-3t7yxs7pcq6bihciyqway6qnhvhrol2fgy2tdaa-0lu-script.googleusercontent.com/blank</code>The page drops a PowerShell command into the clipboard and tells the victim to paste. Classic ClickFix. The 309-byte payload (SHA256:&nbsp;<code>07b96e5c...e6c26edebf, detected as&nbsp;HTML:Clipboard-A</code>) triggers the base64-encoded stager download from&nbsp;<code>j0o.pw/core2</code>. The clipboard payload was captured along with the dropped stager — the missing link between the social engineering and the PowerShell chain.<h4>Full Process Tree</h4>See Appendix B, Listing B6&nbsp;<h4>Stage by Stage</h4>0. ClickFix clipboard attack — The victim visits a Google Apps Script page (<code>n-3t7yxs7pcq6bihciyqway6qnhvhrol2fgy2tdaa-0lu-script.googleusercontent.com</code>) with a fake verification or update prompt. The page silently copies a PowerShell command to the clipboard and tells the user to hit Win+R and paste. That 309-byte payload (<code>HTML:Clipboard-A</code>) kicks off everything — the Chrome InnoSetup download and the hidden PowerShell downloader both trace back to that paste. Google Apps Script: trusted domain, free hosting, URLs you can’t blocklist without catching the whole neighborhood in the net.1. Dropper download — Chrome pulls <code>GAPI_Update.exe</code> from Dropbox (<code>uc0be8c69...dl.dropboxusercontent.com</code>). 60 MB InnoSetup. Extracts benign DLLs (<code>msvcp140.dll, vcruntime140.dll, WebView2Loader.dll</code>) to <code>%LOCALAPPDATA%\Connector\</code>. Looks like a real install. Looks like a lot of things that aren’t.2. Hidden PowerShell BITS downloader — A PowerShell process with <code>-W Hidden -E &lt;base64&gt;</code>. The decoded command uses BITS Transfer — Windows’ Background Intelligent Transfer Service — to grab the next script:

BITS runs through <code>svchost.exe</code>, not PowerShell. Legitimate Windows service. Many endpoint tools never look. The script runs, then deletes itself. Fileless delivery. No artifact left behind but the memory of the thing.The&nbsp;<code>sys.ps1</code> stager — decoded content:Live payloads downloaded from both endpoints (infrastructure still serving as of February 8, 2026): <code>/core</code> is 6,944 bytes (SHA256: <code>a7fafc75...079fa3e2</code>, <a href="https://www.virustotal.com/gui/file/a7fafc75426a3b31dc89915cc79c014ad094bfcb98d69c39af4a0847079fa3e2">VT</a>); <code>/core2</code> is 6,972 bytes (<code>94c964eb...cd800fd</code>). Same structure: base64-wrapped payload, <code>$e</code> = <code>[System.Convert]::FromBase64String('...'); Invoke-Expression [System.Text.Encoding]::UTF8.GetString($e)</code>.3. Fake “Windows Security Update” progress bar — The script brings the console to the foreground with Add-TypeP/Invoke:See Appendix B, Listing B7&nbsp;<code>Add-</code>Type compiles via <code>csc.exe</code> — producing <code>pvxhy3qg.cmdline</code> and <code>bz2ytolk.cmdline</code> invocations in the process tree. Not AMSI bypass. Just bringing the window forward and resizing to 80x20. Then an animated ASCII progress bar. 420 seconds. Seven minutes. 24 milestones. The victim watches. The real work happens in the background.See Appendix B, Listing B8&nbsp;4. XOR-encrypted triple loader download — While the progress bar ticks, a background <code>Start-Job</code> downloads three loaders via BITS Transfer, <code>Invoke-RestMethod</code> as fallback. Each file: base64 blob decrypted with a 256-byte repeating XOR key:See Appendix B, Listing B9&nbsp;Base64 decode. XOR each byte against the key, cycling every 256. We verified: both <code>t4e.pw/res1.php</code> (2.6 MB) and <code>t4e.pw/res4.php</code> (2.7 MB) decrypt to valid PE64 with <code>MZ</code> headers. Three loaders, executed sequentially with 30–41 second delays. Hidden.Endpoint versioning: <code>/core uses</code> res{1–3}, <code>/core2</code> uses res{4–6}. Domains split: <code>j0o.pw</code> = stagers, <code>t4e.pw/re3.pw</code> = loaders.<table class="table"><tbody><tr><td>Stager version</td><td>Loader 1</td><td>Loader 2</td><td>Loader 3</td></tr><tr><td>/core (6,944 B)</td><td>t4e.pw/res1.php</td><td>t4e.pw/res2.php</td><td>re3.pw/res3.php</td></tr><tr><td>/core2 (6,972 B)</td><td>t4e.pw/res4.php</td><td>t4e.pw/res5.php</td><td>re3.pw/res6.php</td></tr></tbody></table>

5. Loader execution and unpacking chain — Decrypted loaders land in <code>%LOCALAPPDATA%\Microsoft\Windows\UpdateCache\</code> as <code>updateWeb_Microsoft_v7028111.exe</code> and kin. Fake version strings: “Breathtaking Output 383” / “Global Channel Port Limited”. Server-side polymorphism. Fresh build per download.Complete unpacking chain: seven layers — base64 → XOR → AES-CBC overlay → hex-encoding → CTR cipher → LZNT1 → AES-CBC + byte transforms. Both chains deliver the same 683 KB stealer, compiled 19 minutes apart:See Appendix B, Listing B10Binary comparison: .<code>data</code> section byte-for-byte identical. <code>.text</code> differs by 48 bytes. Campaign IDs: “meow” vs “gapi”.6. Detection — The captured instance (<code>eee3f818</code>..., 13 MB) spawned twice. First instance proceeded with extraction. Second spawned dllhost.exe. Behavioral detection terminated the second instance as the loader tried to disable Event Tracing for Windows before execution.<h4>New Infrastructure: The PowerShell C2 Layer</h4>Four domains. Delivery and exfiltration split like a good heist crew:

<table class="table"><tbody><tr><td>Domain</td><td>Role</td><td>Endpoints</td><td>IP</td><td>Protocol</td></tr><tr><td>j0o.pw</td><td>Stager only</td><td>/core, /core2</td><td>84.200.125.231</td><td>HTTPS</td></tr><tr><td>t4e.pw</td><td>Loader only</td><td>/res1.php–/res5.php</td><td>84.200.125.231</td><td>HTTPS</td></tr><tr><td>re3.pw</td><td>Loader only</td><td>/res3.php, /res6.php</td><td>84.200.125.231</td><td>HTTPS</td></tr><tr><td>si-dodgei.digital</td><td>Stealer C2</td><td>/api/auth, /api/upload/*</td><td>104.21.50.122 (Cloudflare)</td><td>HTTPS</td></tr></tbody></table>

All three <code>.pw</code> domains hit the same IP (84.200.125.231). <code>j0o.pw</code> and <code>t4e.pw</code> registered January 28, 2026 — same day, PublicDomainRegistry.com, <code>orderbox-dns.com</code> DNS, Let’s Encrypt certs issued together. Palau TLD. Short names. Disposable. SOA emails: <code>ellisdtum@gmx.com</code>, <code>jameyjswoeste@gmx.com</code>. GMX. Throwaway.Infrastructure still live as of February 8, 2026. Server-side polymorphism confirmed. <code>si-dodgei.digital</code> = new stealer C2 — registered December 24, PDR, Cloudflare. Separate delivery and exfiltration. Bad burns on the loader side don’t touch active stealers. Burns on the stealer C2 don’t touch the delivery pipeline. Operational resilience. The kind of planning that keeps you in business.<h2>Technical highlights</h2><h3>Direct syscalls with PRNG obfuscation</h3>The malware resolves NT syscall numbers the hard way – parsing&nbsp;<code>ntdll.dll</code>’s export table straight from the PEB, scanning for&nbsp;<code>syscall;</code> ret byte patterns, and storing the results in a table encrypted with a custom PRNG. The seed comes from&nbsp;<code>QueryPerformanceCounter</code>, PID, TID, and stack ASLR – four sources of randomness stirred together like a bartender making a cocktail that nobody ordered. Twenty syscalls wrapped, covering process injection for ABE key extraction, file I/O for prying open locked browser databases, and process termination for killing browsers that have the bad manners to hold file locks while someone’s trying to rob them.<h3>App-Bound Encryption bypass: A 20 KB reflective DLL</h3>Starting with Chrome 127 in July 2024, Google introduced Application Bound Encryption (ABE) – the browser’s master encryption key chained to the browser’s own process identity via a Windows Elevation Service COM interface. A neat trick. Credentials could only be decrypted from within a trusted browser process. It was the kind of lock that made honest people feel safe and dishonest people feel challenged.Torg Grabber solved it with a lockpick that weighed exactly 19,968 bytes. A ChaCha20-encrypted Reflective DLLburied in the .rdata section like a razor blade in an apple.See Appendix A, Figure A3<h4>The Encrypted Payload</h4>The DLL sits at a fixed offset in <code>.rdata</code> as an undifferentiated byte blob – no PE headers showing, nothing to catch the eye in static analysis. It might as well have been a patch of wallpaper. The parent function decrypts it in-place with a custom ChaCha20 implementation: hardcoded 256-bit key, 96-bit nonce, 312 blocks of 64 bytes. After decryption, the MZ and PE signatures emerge like a face surfacing in dark water, and the code walks the export directory looking for one specific string: ReflectiveLoader.We extracted and decrypted the payload. It had the following particulars:

<table class="table"><tbody><tr><td>Property</td><td>Value</td></tr><tr><td>Size</td><td>19,968 bytes (0x4E00)</td></tr><tr><td>Architecture</td><td>x64 PE32+</td></tr><tr><td>Compiler</td><td>GCC 15.2.0 (MSYS2 MinGW-w64)</td></tr><tr><td>Exports</td><td>ReflectiveLoader, GetIp</td></tr><tr><td>Sections</td><td>10 (.text, .data, .rdata, .pdata, .xdata, .bss, .edata, .idata, .tls, .reloc)</td></tr></tbody></table>

The <code>ReflectiveLoader</code> export is textbook reflective injection: it walks backwards from <code>GetIp()</code> to find its own MZ header, resolves <code>LoadLibraryA</code>, <code>GetProcAddress</code>, and <code>VirtualAlloc</code> from kernel32.dll via PEB walking and ROR13 export name hashing, maps sections, processes relocations, resolves imports, flushes the instruction cache, and calls <code>DllMain</code>. Standard procedure. The kind of thing they’d teach in school if schools taught this sort of thing.<h4>Browser Detection and COM Elevation</h4>Once loaded, the DLL spawns a worker thread that reaches back to the parent through a named pipe and collects the ABE-encrypted key material. Then it figures out where it’s living. A call to <code>GetModuleFileNameW</code>, the path lowercased and matched against a list of known executables and installation directories – like a kidnapping victim recognizing the room by the wallpaper:

<table class="table"><tbody><tr><td>Browser</td><td>Process / Path Match</td><td>Own CLSID</td><td>IID Variants</td><td>Vtable Offset</td></tr><tr><td>Edge</td><td>msedge.exe, \microsoft\edge\</td><td>{1FCBE96C-...}</td><td>2</td><td>+64</td></tr><tr><td>Chrome</td><td>chrome.exe, \google\chrome\</td><td>{708860E0-...}</td><td>3</td><td>+40</td></tr><tr><td>Brave</td><td>brave.exe, \brave-browser\</td><td>{576B31AF-...}</td><td>2</td><td>+40</td></tr><tr><td>Avast</td><td>avastbrowser.exe, \avast software\browser\</td><td>{EAD34EE8-...}</td><td>1</td><td>+40</td></tr><tr><td>AVG</td><td>avgbrowser.exe, \avg\browser\</td><td>{EDC3300F-...}</td><td>1</td><td>+40</td></tr><tr><td>Vivaldi</td><td>vivaldi.exe, \vivaldi\</td><td>Chrome’s CLSID</td><td>3</td><td>+40</td></tr><tr><td>Opera</td><td>opera.exe, \opera software\</td><td>Chrome’s CLSID</td><td>3</td><td>+40</td></tr></tbody></table>

Each Chromium-based browser that implements ABE registers its own Elevation Service COM class with a browser-specific CLSID. The DLL carries five of these like a skeleton key ring: Chrome, Edge, Brave, Avast, AVG. For Vivaldi, Opera, and any unknown Chromium fork that wanders into the crosshairs, it falls back to Chrome’s CLSID and hopes for the best.There’s a wrinkle, though, and it matters: Edge uses a different vtable layout. Extra methods in the interface push DecryptData to vtable offset +64 – method index 8 – instead of the standard +40, method index 5. Everyone else lines up neatly. Edge has to be different. The DLL handles this with a branch on browser type ID, because in this line of work, the details are what keep you out of trouble or put you in it.After creating the COM object with CoCreateInstance(CLSCTX_LOCAL_SERVER), the DLL calls CoSetProxyBlanket with RPC_C_AUTHN_LEVEL_PKT_PRIVACY and EOAC_DYNAMIC_CLOAKING to set the security context, then invokes IElevator::DecryptData with the encrypted key wrapped in a BSTR. When it works – and it works more often than Google would like – the method hands back a 32-byte BSTR: the AES-256 master key. The keys to the kingdom, delivered through the kingdom’s own front door.<h4>The Response</h4>The decrypted master key is packed into a 44-byte response and written back through the named pipe, neat as a coroner’s report:

The DLL carries debug logging <code>– [DLL] Detected: Chrome, [DLL] Elevator object created with IID variant 2, [DLL] Master key extracted successfully! </code>– that gets buffered and sent back with the key. Development artifacts left in the production code, like a carpenter’s pencil marks under the paint. Sloppy, maybe, but also human. After the response goes through, the parent process terminates the suspended browser and uses the recovered master key to decrypt the Chromium <code>encrypted_key</code> from <code>Local State</code>, which unlocks the credential entries in <code>Login Data</code>, <code>Cookies</code>, and <code>Web Data</code>. The vault door swings open. Everything inside belongs to someone else.<h4>Corpus-Wide ABE Timeline</h4>The encrypted DLL blob runs hot with entropy in the PE’s&nbsp;.rdata section, and the parent binary always carries the string&nbsp;"<code>ReflectiveLoader</code>" – both traits as distinctive as a scar. We didn’t need to decrypt anything to spot ABE capability across all 139 samples. Automated triage told the story:<table class="table"><tbody><tr><td>Phase</td><td>Samples</td><td>ABE Bypass</td><td>Blob Size</td></tr><tr><td>Telegram Bot API (Dec 9–11)</td><td>25</td><td>None</td><td>–</td></tr><tr><td>GRAB TCP Protocol (Dec 17–20)</td><td>4</td><td>None</td><td>–</td></tr><tr><td>REST API, first build (Dec 18)</td><td>1</td><td>None</td><td>–</td></tr><tr><td>REST API, production (Dec 22+)</td><td>109</td><td>All</td><td>18–20 KB</td></tr><tr><td>GRABBER variant w/o ABE (Feb 3)</td><td>1</td><td>None</td><td>–</td></tr></tbody></table>The ABE bypass shipped with the very first dedicated C2 domain build – <code>attackzombie.com</code>, December 22, 2025 – and rode along in every REST API sample since. Not a later addition. A launch feature. The developers considered it essential equipment, the way a safecracker considers a stethoscope. The lone exception was a 122 KB <code>safeguss.com</code> sample from February 3 that looked more like a stripped loader than the full stealer – a scout, not the army.The encrypted blob grew over time, the way a pickpocket’s ambition grows:See Appendix A, Figure A4The 18-to-19 KB growth around December 29 lines up with the addition of Avast and AVG Secure Browser CLSIDs. Two 20 KB blobs flickered into existence on January 26–27 and then vanished – an experimental build that got trimmed back, like a line of dialogue that didn’t make the final cut.<h3>Operator tags: Fingerprinting the MaaS customers</h3>Every REST API build carries an operator tag – a short string identifying the customer, sent as the first field in the C2 registration. A calling card. A signature on the dotted line. The tag is resolved through a two-tier mechanism: the malware checks the <code>GRABBER_TAG</code> environment variable first, and only falls back to a hardcoded default if the env var comes up empty:

In older builds, the fallback tag sits in .rdata between the mutex format string "<code>Local\%s</code>" and the C2 domain – as conspicuous as a name tag at a criminal convention. In newer builds, the compiler inlines short tags as <code>mov</code> immediates (e.g., <code>mov dword ptr [rip+disp], 73756564h</code> for “deus”), and the longest tags use <code>mov rax</code>, <code>imm64</code>. Even the machine code has an opinion about how to keep a secret.At runtime, the resolved tag gets copied into a 640-byte registration structure and shipped off to <code>/api/auth</code> along with the machine’s vital statistics:

A brief experiment – five samples across three days in early February – pushed the idea further: the payload read everything from environment variables. <code>GRABBER_HOST</code>, <code>GRABBER_TAG</code>, <code>GRABBER_ANTI_SNG</code>,<code>GRABBER_ANTI_VM</code>, <code>GRABBER_STREAMING</code>. One binary to serve them all. A universal key. At first it looked like the experiment died after three days – subsequent builds went back to hardcoded domains and tags. But starting Feb 10, the env-var mechanism came back for good: every build from Feb 10 onward includes <code>GRABBER_*</code> env var support alongside hardcoded defaults, and the builder simultaneously switched all operators from plaintext <code>.rdata</code> strings to compiler-inlined <code>mov</code> immediates. A unified builder update. The stealer became truly operator-agnostic – the way a gun doesn’t care whose hand it’s in.Across the corpus, we extracted over 40 distinct operator tags. The most active:<table class="table"><tbody><tr><td>Count</td><td>Tag</td><td>Type</td><td>Domains Used With</td></tr><tr><td>42x</td><td>5197705037</td><td>Telegram ID (confirmed)</td><td>gogenbydet.cc, technologytorg.com, bbcplay.top, playbergs.info</td></tr><tr><td>24x</td><td>8172045377</td><td>Telegram ID (confirmed)</td><td>gogenbydet.cc, bbcplay.top, playbergs.info</td></tr><tr><td>24x</td><td>main1402_2</td><td>Date-encoded batch</td><td>evasivestars.com</td></tr><tr><td>19x</td><td>0902</td><td>Numeric (build ID?)</td><td>evasivestars.com</td></tr><tr><td>16x</td><td>5362456016</td><td>Telegram ID (confirmed)</td><td>gogenbydet.cc, bbcplay.top, playbergs.info</td></tr><tr><td>15x</td><td>main1402</td><td>Date-encoded batch</td><td>evasivestars.com</td></tr><tr><td>14x</td><td>5551690712</td><td>Telegram ID (confirmed)</td><td>gogenbydet.cc, bbcplay.top</td></tr><tr><td>9x</td><td>Main</td><td>Nickname</td><td>sinixproduction.com, startbuldingship.com, technologytorg.com</td></tr><tr><td>9x</td><td>578510323</td><td>Telegram ID (confirmed)</td><td>gogenbydet.cc</td></tr><tr><td>7x</td><td>Den</td><td>Nickname</td><td>technologytorg.com, attackzombie.com</td></tr><tr><td>7x</td><td>7612929707</td><td>Numeric (unresolved)</td><td>gogenbydet.cc, bbcplay.top, playbergs.info</td></tr><tr><td>6x</td><td>Deus</td><td>Nickname</td><td>attackzombie.com, technologytorg.com, safeguss.com</td></tr><tr><td>5x</td><td>main2402_1</td><td>Date-encoded batch</td><td>evasivestars.com</td></tr><tr><td>4x</td><td>Gapi</td><td>Nickname</td><td>si-dodgei.digital, avanpost-fi.digital</td></tr><tr><td>3x</td><td>Gd</td><td>Initials</td><td>technologytorg.com, attackzombie.com</td></tr><tr><td>3x</td><td>7287445517</td><td>Telegram ID (confirmed)</td><td>gogenbydet.cc</td></tr><tr><td>3x</td><td>main_new</td><td>Nickname</td><td>evasivestars.com, wulingyuanparkzone.com</td></tr><tr><td>3x</td><td>main2002_2</td><td>Date-encoded batch</td><td>evasivestars.com</td></tr><tr><td>3x</td><td>Meow</td><td>Nickname</td><td>si-dodgei.digital</td></tr><tr><td>2x</td><td>7488523544</td><td>Telegram ID (confirmed)</td><td>playbergs.info</td></tr><tr><td>2x</td><td>8251115314</td><td>Numeric (unresolved)</td><td>playbergs.info</td></tr><tr><td>2x</td><td>7694683550</td><td>Numeric (unresolved)</td><td>gogenbydet.cc, playbergs.info</td></tr><tr><td>2x</td><td>main2</td><td>Nickname</td><td>technologytorg.com</td></tr><tr><td>2x</td><td>BB1</td><td>Nickname</td><td>safeguss.com</td></tr><tr><td>2x</td><td>main7</td><td>Nickname</td><td>evasivestars.com</td></tr><tr><td>2x</td><td>main2302_1</td><td>Date-encoded batch</td><td>evasivestars.com</td></tr><tr><td>2x</td><td>pb2</td><td>Nickname</td><td>safeguss.com</td></tr><tr><td>2x</td><td>deus_auto</td><td>Nickname</td><td>wulingyuanparkzone.com</td></tr><tr><td>2x</td><td>capha2</td><td>Nickname</td><td>safeguss.com</td></tr></tbody></table>

Three kinds of tags now: nicknames (<code>den, deus, gd, tf, main, BB1, BattleBuild, capha2, pb2</code>) – the kind of names men give themselves when they think nobody’s looking. Date-encoded batch IDs (<code>main1402, main1402_2, main2002_2, main2302_1,main2402_1</code> – where the digits encode the build date as DDMM) – <code>evasivestars.com</code> alone received 74 samples through this mechanism, each tag a timestamp on a factory floor. And numeric Telegram user IDs that we confirmed by running eight of twelve through the TelegramDB OSINT database. The C2 panel uses the IDs to route stolen-goods notifications to the operator’s Telegram. The <code>main/main2/main5/main7/main_new/main10</code> progression suggests a developer tag, while the date-encoded variants (<code>main1402</code> = Feb 14 batch) indicate automated nightly builds. The deus lineage evolved through <code>deus_new3</code>, <code>deus_new4</code>, and <code>deus_auto</code> on <code>wulingyuanparkzone.com</code> – iterative testing, like a man trying on aliases until one fits.<h4>Unmasking the Operators</h4>Running the numeric tags through TelegramDB was like pulling masks off at a costume party. Underneath, the faces were about what you’d expect:<table class="table"><tbody><tr><td>Tag</td><td>Telegram Name</td><td>Username</td><td>Previous Usernames</td><td>Notable</td></tr><tr><td>5197705037</td><td>F̲a̲s̲o̲L̲’</td><td>@Pi55_0ff</td><td>@SCAMHERE1</td><td>Top operator, 42 samples. Previous username is a confession</td></tr><tr><td>8172045377</td><td>финфанфун</td><td>@ytcel</td><td>@zxcnork, @jxnxdxsxxm</td><td>24 samples. Russian display name</td></tr><tr><td>578510323</td><td>(hidden)</td><td>@mamontovv</td><td>@reportmamont, @mamont0w, @rukoeb_3000</td><td>9 samples. “Мамонт” = Russian for a scam victim. Premium</td></tr><tr><td>5551690712</td><td>L1man</td><td>@ezbonus22</td><td>@hydrosh0t, @lox3526tyrk</td><td>14 samples. “лох” = Russian for sucker</td></tr><tr><td>7287445517</td><td>ANRILOV | PAYPAL</td><td>@anrilovfck</td><td>@cryptowoma, @ebalvseh11</td><td>3 samples. Bio: “PAYPAL WORK | MALWARE MONSTER”. Premium</td></tr><tr><td>5362456016</td><td>Tony Montana</td><td>@scarface_logs</td><td>@G5zvkr</td><td>16 samples. Bio links @NoMetaRu (logs marketplace). Profile pic: Scarface still with “SCARFACE LOGS” overlay. Premium, DC4</td></tr><tr><td>7488523544</td><td>123 1</td><td>@scamsomebody</td><td>@declineeeeed, @dennnied1</td><td>2 samples. Username literally @scamsomebody. Previous names reference declining/denying – chargebacks? Premium</td></tr><tr><td>1527633244</td><td>(hidden)</td><td>@wordpress20</td><td>@teamphoenixs, @sneqixolod</td><td>1 sample. “teamphoenix” – possibly group-affiliated</td></tr><tr><td>7694683550</td><td>(not indexed)</td><td>–</td><td>–</td><td>2 samples. A ghost</td></tr><tr><td>8598114766</td><td>(not indexed)</td><td>–</td><td>–</td><td>1 sample</td></tr><tr><td>8251115314</td><td>(not indexed)</td><td>–</td><td>–</td><td>2 samples</td></tr><tr><td>8402108450</td><td>(not indexed)</td><td>–</td><td>–</td><td>1 sample</td></tr></tbody></table>

The username histories read like a glossary of Russian cybercrime slang. “Мамонт” – mammoth – is what they call a scam victim, from the expression “мамонт пришел,” the mammoth has arrived. “Лох” – sucker, mark, the one holding the short end. @SCAMHERE1 needs no translation in any language. One operator’s public bio announces “PAYPAL WORK | MALWARE MONSTER” with the quiet pride of a man who put his occupation on his tax return. <code>@scarface_logs</code>– “Tony Montana” – links to <code>@NoMetaRu</code>, a logs marketplace, and uses a Scarface movie still with “SCARFACE LOGS” branding as a profile picture. Subtle as a brick through a window. The newest arrival, <code>@scamsomebody</code>, leaves even less to interpretation, with previous usernames <code>@declineeeeed</code> and <code>@dennnied1</code> suggesting chargeback fraud experience – the kind of resume you don’t put on LinkedIn. Four carry Telegram Premium – these aren’t burner accounts tossed after a single job. These are established identities, permanent residents in the Russian cybercrime neighborhood, the kind of people who pay rent and expect the landlord to fix the plumbing.All eight resolved accounts were still publicly accessible at the time of writing (Mar 2026). Nobody had bothered to draw the curtains.Several tags appear across multiple C2 domains. den shows up on builds for both <code>technologytorg.com</code> and <code>attackzombie.com.deus</code> spans three domains. Most strikingly, we observed a full domain rotation chain for the numeric-ID operators: <code>gogenbydet.cc</code> (Dec 22 – Feb 12) → <code>bbcplay.top</code> (Feb 12 – Feb 22) → <code>playbergs.info</code> (Feb 22 – present). Operators <code>5197705037</code>, <code>8172045377</code>, <code>5362456016</code>, <code>7612929707</code>, and <code>7694683550</code> all followed this migration path, like a parade of regulars moving to a new bar every ten days. New operators (<code>7488523544, 8251115314, 8402108450</code>) appeared directly on playbergs.info – fresh faces who never knew the old place. The tags identify operators, not infrastructure, and the seamless migration suggests the panel backend can redirect operators to new domains without breaking stride. The early Telegram and GRAB TCP builds predate the mechanism entirely – no tags, no calling cards, just the raw proto-malware feeling its way in the dark.The env-var mechanism combined with hardcoded fallbacks is the smoking gun for the MaaS model. The builder can bake operator-specific values into the binary or delegate everything to the dropper, letting a single compiled payload serve any customer who walks through the door. It’s the franchise model, applied to crime.<h2>C2 infrastructure</h2>Eighteen C2 domains identified over twelve weeks, most tucked behind Cloudflare like witnesses in a protection program:<table class="table"><tbody><tr><td>Domain</td><td>Registered</td><td>Samples</td><td>Notes</td></tr><tr><td>gogenbydet.cc</td><td>Dec 22</td><td>74</td><td>Dominant Jan–Feb; operators migrated out</td></tr><tr><td>evasivestars.com</td><td>~Feb 2</td><td>74</td><td>Exploded via date-encoded batch builds</td></tr><tr><td>bbcplay.top</td><td>Feb 11</td><td>33</td><td>Active Feb 12–22; PDR registrar; fake Chrome installer delivery</td></tr><tr><td>technologytorg.com</td><td>Dec 24</td><td>33</td><td>Contains “torg” – where the name came from</td></tr><tr><td>playbergs.info</td><td>Feb 22</td><td>18</td><td>Current primary for numeric-ID operators; NiceNic registrar</td></tr><tr><td>attackzombie.com</td><td>Dec 16</td><td>10</td><td>First dedicated C2, the one that started it</td></tr><tr><td>safeguss.com</td><td>~Feb 3</td><td>7</td><td>Growing; operators pb2, capha2, BB1, deus</td></tr><tr><td>si-dodgei.digital</td><td>Dec 24</td><td>5</td><td>Stealer C2 for delivery chain; PDR registrar</td></tr><tr><td>wulingyuanparkzone.com</td><td>Feb 3</td><td>5</td><td>deus lineage operators; 22-char domain spans 3 mov immediates</td></tr><tr><td>sinixproduction.com</td><td>2021 (!)</td><td>3</td><td>An old domain with a new purpose</td></tr><tr><td>avanpost-fi.digital</td><td>~Feb 19</td><td>2</td><td>gapi operator (same as si-dodgei.digital); PDR registrar</td></tr><tr><td>50elk.com</td><td>Jun 2024 (!)</td><td>2</td><td>Different C2 backend (/api/machine/set-files-r); NiceNic registrar; VT 10/93</td></tr><tr><td>new-app-techno.com</td><td>Feb 3</td><td>1</td><td>Operator File_23; Realtime Register (PDR reseller); Cloudflare</td></tr><tr><td>findyour-dreams.com</td><td>Dec 28</td><td>1</td><td>&nbsp;</td></tr><tr><td>startbuldingship.com</td><td>Jan 5</td><td>1</td><td>Typo: “bulding” – even criminals can’t spell</td></tr><tr><td>quick-neo.com</td><td>Oct 2025</td><td>1</td><td>/api/machine/set-files-r backend (earliest sample); pre-staged domain</td></tr></tbody></table>

The C2 infrastructure tells a story of domain rotation – organized, deliberate, like a crew that knows when to move. gogenbydet.cc dominated from late January through early February, then operators migrated to <code>bbcplay.top</code> (Feb 12–22), which was in turn replaced by <code>playbergs.info</code> (Feb 22 – present). Meanwhile, evasivestars.com quietly became the highest-volume domain through automated batch builds with date-encoded operator tags, now tied with <code>gogenbydet.cc</code> at 74 samples each – a factory nobody noticed because it didn’t make noise. A separate infrastructure cluster uses <code>.digital</code> TLD domains (<code>si-dodgei.digital, avanpost-fi.digital</code>) registered through the same PDR registrar, both serving the <code>gapi/meow</code> operator. Combined with the operator tags and the <code>GRABBER_HOST</code> environment variable, the picture is clear enough to read without glasses: Malware-as-a-Service, a builder model where each customer gets a binary with their name and C2 address baked in. The twelve numeric operator tags – eight confirmed as live Telegram accounts – prove the panel routes stolen data notifications straight to the operator’s phone. The Telegram-only exfiltration model didn’t die; it evolved into a notification layer sitting on top of the REST API architecture. Old habits don’t die. They get promoted.<h3>Registrar clustering and WHOIS overlap</h3>Three major registrar clusters emerged, and the WHOIS data gave us a gift – direct registrant identity links across multiple domains, wrapped up with a bow:

<table class="table"><tbody><tr><td>Registrar</td><td>Domains</td><td>WHOIS Registrant</td><td>VT Detections</td></tr><tr><td>Global Domain Group#3956</td><td>technologytorg.com, safeguss.com, evasivestars.com</td><td>Redacted; all three registered within 6 weeks (Dec 24 – Feb 2)</td><td>11/93, 0/93, 0/93</td></tr><tr><td>NiceNIC (HK) #3765</td><td>gogenbydet.cc, findyour-dreams.com, playbergs.info,50elk.com</td><td>Same registrant name hash 1f8f4166599d23ee across all four; two email clusters: 9253e579452ffad5s@(gogenbydet/findyour-dreams) and 6eb609d996e182a6s@ (playbergs/50elk). 50elk.comregistered Jun 2024 (pre-staged); Peru registrant.</td><td>1/93, 8/93, 2/93, 10/93</td></tr><tr><td>Registrar.eu (NL)#1647</td><td>attackzombie.com</td><td>Whois Privacy Protection Foundation (NL)</td><td>8/93</td></tr><tr><td>Dynadot #472</td><td>sinixproduction.com</td><td>Super Privacy Service LTD; domain from 2021, repurposed Jan 2026</td><td>0/93</td></tr><tr><td>Realtime Register (NL) #839</td><td>startbuldingship.com, new-app-techno.com</td><td>Finland / Germany (Thüringen); PDR reseller for new-app-techno.com; startbuldingship.com suspended</td><td>0/93, 1/93</td></tr><tr><td>PDR / PublicDomainRegistry#303</td><td>si-dodgei.digital,&nbsp;bbcplay.top,&nbsp;avanpost-fi.digital</td><td>GDPR-masked (Germany) / “Filip Cooper” (Seychelles); three C2 domains through same registrar; si-dodgei.digital and avanpost-fi.digital share .digital TLD and gapi operator</td><td>0/93, 0/93, 0/93</td></tr><tr><td>Hostinger #1636</td><td>wulingyuanparkzone.com</td><td>Lithuania</td><td>0/93</td></tr><tr><td>Dominet/Aliyun (HK)#3775</td><td>quick-neo.com</td><td>Malaysia; registered Oct 2025 – 2 months before first sample</td><td>2/93</td></tr></tbody></table>The NiceNIC cluster was the strongest find – and it grew. All four domains share the exact same registrant name hash (<code>1f8f4166599d23ee</code>), split into two email-address pairs: <code>gogenbydet.cc/findyour-dreams.com</code> (email <code>9253e579452ffad5s@</code>, Hong Kong/Ohio registrants) and <code>playbergs.info/50elk.com</code> (email <code>6eb609d996e182a6s@</code>, Hong Kong/Peru registrants). The shared name hash proves all four were registered by the same individual despite claiming different countries. Same hand, same pen, four different post offices. Notably, <code>50elk.com</code> was registered in June 2024 – eight months before the first Torg Grabber sample – and carries 10/93 VT detections with 2,000–4,000 daily malware hits, suggesting it was already in the business before being repurposed as a Torg Grabber C2. The Global Domain Group cluster includes three domains, all registered within a six-week window. The PDR cluster now holds three domains: <code>si-dodgei.digital</code> (Dec 24), <code>bbcplay.top</code>(Feb 11), and <code>avanpost-fi.digital</code> (Feb 19). The <code>.digital</code> pair is particularly telling – both serve the same <code>gapi/meow</code> operator and share the same TLD, confirming they’re managed by the same infrastructure operator. The Realtime Register cluster now includes two domains: <code>startbuldingship.com</code> (Jan 5, Finland, suspended) and <code>new-app-techno.com</code> (Feb 3, Germany/Thüringen), the latter sold through PDR as reseller – creating a cross-link to the PDR cluster, the way one lie always connects to another. The operation used eight registrars across Hong Kong, the US, the Netherlands, Germany, the Seychelles, Peru, Finland, and Lithuania – diversifying against takedowns the way a smart investor diversifies against market crashes.Three domains stuck out like sore thumbs in a velvet glove:<ul><li data-list-item-id="ee891671d04e4d6332b6927e95f08c327"><code>sinixproduction.com</code> was registered in January 2021 – five years before Torg Grabber drew its first breath. Its nameservers were switched to Cloudflare on January 13, 2026. An acquired domain, or a compromised one. Either way, it had a past, and its past wasn’t in malware.</li><li data-list-item-id="e131fd0d8f98bd4f1e3ca771a168a134d"><code>50elk.com</code>, registered June 17, 2024 via NiceNic, carried 2,000–4,000 daily malware hits in our domain reputation data before Torg Grabber even existed. Deep analysis in IDA Pro reveals these builds use a completely different C2 backend – <code>POST /api/machine/set-files-r</code> with multipart form-data uploads – rather than Torg Grabber’s native REST API. Despite the different exfiltration protocol, the binaries share the full <code>GRABBER_*</code> environment variable framework, anti-VM/anti-CIS checks, and mutex pattern. They self-identify as "<code>grabber v1.0</code>" with plaintext debug messages in <code>.rdata</code>. See A Parallel Backend:&nbsp;<code>/api/machine/set-files-r</code> for details.</li><li data-list-item-id="e364e8168c3762cb784cdc65306447ebf"><code>quick-neo.com</code>, registered October 30, 2025, pre-dates all known samples by six weeks and carries a Cloudflare Radar rank of 10,000 and a Cisco Umbrella rank of ~242,000. IDA Pro analysis confirms its December 18 sample uses the same <code>/api/machine/set-files-r</code> backend as the <code>50elk.com</code> builds – making it the earliest known sample with this protocol, from the same week the REST API transition began. See A Parallel Backend:&nbsp;<code>/api/machine/set-files-r</code> for details.</li></ul><h3>The GRAB TCP server</h3>The two experimental GRAB protocol domains –&nbsp;<code>bk.tara.net.bd</code> and&nbsp;<code>raketa.tara.net.bd</code> – resolve to&nbsp;<code>190.92.174.248</code>, hosted by WHG Hosting Services Ltd (AS199404, UK company, IP geolocated to India). Unlike the REST API domains, this one isn’t hiding behind Cloudflare. It uses a Let’s Encrypt wildcard for&nbsp;<code>*.tara.net.bd</code> and shares the server with&nbsp;<code>potshilpo.shop</code>, a Bangladesh-based domain. Shared hosting. The developer phase, where you don’t yet have the budget or the paranoia for dedicated infrastructure. BitDefender and G-Data flag&nbsp;tara.net.bd as malware. Someone noticed, even if not everyone.<h3>What VT sees: Distribution and delivery</h3>VirusTotal’s communicating files for the three busiest C2 domains tell the story of how Torg Grabber reaches its victims. The delivery mechanism is the oldest trick in the book, dressed up with a fresh coat of paint: trojanized installers, ZIP-packaged lures, digital candy left on the doorstep.Fantasy-themed lures (<code>technologytorg.com</code>): The ten most recent communicating files are 87–113 MB ZIP installers wearing auto-generated fantasy names like costumes at a masquerade:&nbsp;<code>Aerovora.zip</code>,&nbsp;<code>Nebulax.zip</code>,&nbsp;<code>Pyroxis.zip</code>,&nbsp;<code>Ignisyn.zip, Aetherion.zip</code>,&nbsp;<code>Zephyrion.zip</code>,&nbsp;<code>Aquathea.zip</code>,&nbsp;<code>Nebulynx.zip</code>,&nbsp;<code>Luminavora.zip</code>. The naming convention had the mechanical creativity of a builder script that read too many sci-fi paperbacks.Pirated software lures (<code>gogenbydet.cc</code>): Multiple 166 MB ZIPs labeled&nbsp;<code>Terraria_1.4.5.zip</code> and&nbsp;<code>Setup.zip</code> – bait for people who want something for nothing, which is most people. A smaller&nbsp;loader <code>.zip</code> at 31 MB suggested a more targeted delivery chain, something with a shorter fuse.Numeric-ID lures (<code>attackzombie.com</code>): Smaller 3 MB ZIPs with numeric filenames –&nbsp;<code>24323350</code>,&nbsp;<code>24353240</code>,&nbsp;<code>24427545</code> – plus&nbsp;installer <code>.zip</code>. A simpler naming scheme from the earliest REST API domain, back when the operation was still figuring out its wardrobe.Droppers on disk turn up as randomly-named executables in&nbsp;<code>C:\Windows\:&nbsp;v4jkqh.exe</code>,&nbsp;<code>hkjpy08.exe</code>,&nbsp;<code>we4osct.exe</code>, <code>bfp2w6.exe</code>. The naming pattern of a crypter or loader that doesn’t want to be remembered – digital aliases, disposable as matchbook covers.VT label noise: The communicating files are variously tagged&nbsp;<code>Trojan.dacic/vidar</code>,&nbsp;<code>trojan.aotera</code>,&nbsp;<code>trojan. cryptagen</code>t, and even&nbsp;<code>trojan.aotera/rhadamanthys</code> – a mess of misattribution that brought Torg Grabber to our attention in the first place. None of these labels fit. They reflect the industry’s reflex of pinning unknown stealers to familiar family names, the way a police sketch ends up looking like everybody and nobody.All dedicated C2 domains share the same Cloudflare JARM fingerprint (<code>27d40d40d00...525c</code>) and use Google Trust Services TLS certificates. Matching suits. Same tailor.<h2>Attribution: Following the Telegram trail</h2>The 19 early Telegram-exfiltrating samples came with hardcoded bot tokens and channel IDs, carried openly in the binary like monogrammed luggage at an airport. By querying the Telegram Bot API, we obtained bot metadata, channel information, and – the prize – the Telegram accounts of the channel creators. The people who set up the drops. The hands behind the curtain.See Appendix A, Figure A5<h3>The Bots</h3><table class="table"><tbody><tr><td>Bot</td><td>Username</td><td>Status</td></tr><tr><td>8247426625</td><td>@trtest12bot</td><td>Live</td></tr><tr><td>8284437818</td><td>@gr_bot_life_bot</td><td>Live</td></tr><tr><td>8456437646</td><td>@lalllaland_bot</td><td>Live</td></tr><tr><td>8471726820</td><td>@palayodd_bot</td><td>Live</td></tr><tr><td>4 others</td><td>(unknown)</td><td>Revoked</td></tr></tbody></table>Four bots still alive and ticking, tokens unrevoked, as of February 8, 2026. All eight channels private, two to three members each – the bot and one or two humans. Small operations. Tight circles. The kind of crew where everyone knows everyone and nobody knows anyone outside.<h3>The Operators</h3>Each exfiltration channel has a creator – the Telegram account that set up the room and invited the bot. We found four:<table class="table"><tbody><tr><td>Username</td><td>Display Name</td><td>User ID</td><td>Channel</td><td>Notable</td></tr><tr><td>@ChaChaGuru</td><td>Pope Robinson</td><td>7863185848</td><td>“BkChannel”</td><td>ChaCha20 in the username</td></tr><tr><td>@OneCC_team</td><td>OneCC</td><td>7983438838</td><td>“playodd”</td><td>Bio: “Selling CC&gt;First hand&gt;Sniffed”</td></tr><tr><td>@the_01G</td><td>X I</td><td>7960359642</td><td>“land”</td><td>&nbsp;</td></tr><tr><td>(none)</td><td>Lauriev Hontisorknnd</td><td>8214631236</td><td>“1 kanal”</td><td>“1 kanal” = “channel 1” – the test run</td></tr></tbody></table>

@ChaChaGuru was the lead we couldn’t ignore. The username is a direct reference to ChaCha20 – the stream cipher that runs through Torg Grabber’s veins like blood type. It encrypts the C2 payloads. It protects the GRAB protocol. It wraps the shellcode. And the “Bk” in “BkChannel” matches <code>bk.tara.net.bd</code>, the GRAB TCP domain. Two connections. Both pointing the same direction. This wasn’t circumstantial evidence; it was a man leaving his business card at the scene.@OneCC_team presented as a group identity, and their public bio – “Selling CC&gt;First hand&gt;Sniffed” – was an open advertisement for stolen credit card sales. Not even coded. Just stated, plainly, the way a butcher advertises pork chops. Their profile photo history traced a career arc from an Amazon delivery truck through “OMG” and Bitcoin/AML imagery to a Guy Fawkes mask – a trajectory from e-commerce fraud through cryptocurrency crime to the anonymous hacking persona, documented in selfies.All four creator accounts carry user IDs in the 7.8–8.2 billion range – created in the same timeframe, shortly before the bots themselves. The channel called “1 kanal” (Russian for “channel 1”) by “Lauriev Hontisorknnd” – a name as fabricated as a three-dollar bill – was the test channel. The first attempt. The rough draft.<h2>What Torg Grabber steals</h2>The stealer’s appetite is broad, and it’s getting broader. It wants everything, and it’s not shy about asking.Here’s the rap sheet:<ul><li data-list-item-id="e6c94f8f1812a2022dd1d2f3d7da713fc">Browser credentials: 25 Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex, CocCoc, CryptoTab, and 17 others that never thought they’d end up on a list like this) and 8 Firefox-family browsers, with AES-GCM, DPAPI, and ABE support. Plus harvesting of credentials previously extracted by the “Underground” tool – a standalone credential extraction tool whose output Torg Grabber scavenges like a jackal following a lion (see below)</li><li data-list-item-id="e189ced2b07dbbe824fef40f0391ad7f0">Browser extensions – 850 total: Three hardcoded lists. 728 wallet extensions covering every crypto wallet from MetaMask and Phantom down to ShibaWallet and xMetaCene. 103 password/2FA extensions – LastPass, 1Password, Bitwarden, and every authenticator app that ever tried to keep someone safe. 19 notes extensions, because sometimes people write their passwords on sticky notes, even digital ones. Full lists in the&nbsp;<a href="https://github.com/gendigitalinc/ioc" target="_blank">IOC repository</a></li><li data-list-item-id="e902a0534ddd9db1b31ca1626e07310a9">Desktop wallets: 30+ standalone applications – Exodus, Atomic, Electrum, Monero, Daedalus. The whole menagerie</li><li data-list-item-id="e8584d6b90fd45056b2e40596641095c2">Messaging: Discord tokens (LevelDB scanning), Telegram session data, Steam configs</li><li data-list-item-id="ea137fd09ecd26e88aaf53686e2757bc6">Credentials: VPN configs from 8 providers, FTP clients (5), email (Thunderbird, Outlook), password managers (7), gaming platforms (6)</li><li data-list-item-id="ef207f85eab7a553a1507c70c0dd6959d">System profiling: Hardware fingerprint, installed software, process list, screenshot, environment variables, and AV detection scanning 46 process signatures across 24 products – Kaspersky, Avast, ESET, CrowdStrike, SentinelOne, Windows Defender. It wants to know who’s watching before it starts working, the way a burglar checks for dogs before climbing the fence</li><li data-list-item-id="eaec55d241c9ae2b5988c1e458dd1ac8c">File grabbing: Pattern-based collection from Desktop and Documents with C2-configurable rules</li><li data-list-item-id="e5c1348e1d786ad029539f7c229d1606d">Arbitrary code execution: The C2 can deliver ChaCha-encrypted, zlib-compressed shellcode at registration. Just in case everything else wasn’t enough</li></ul><h2>850 browser extensions: Casting the widest net</h2>Perhaps the most striking thing about Torg Grabber isn’t what it does, but how much of it there is. Eight hundred and fifty extension IDs, hardcoded into the binary, organized into three tidy categories like a catalog for a store that sells things that don’t belong to it:<table class="table"><tbody><tr><td>Category</td><td>Count</td><td>Archive Path</td><td>What They Steal</td></tr><tr><td>Wallet</td><td>728</td><td>Wallet/Extension/</td><td>Crypto wallet seeds, keys, session data</td></tr><tr><td>Password/2FA</td><td>103</td><td>Password/</td><td>Password vaults, TOTP secrets, MFA tokens</td></tr><tr><td>Notes</td><td>19</td><td>Notes/</td><td>Saved notes – and the passwords people hide in them</td></tr></tbody></table>The 728 wallet extensions cover essentially every crypto wallet ever conceived by human optimism. The marquee names are all there – MetaMask, Phantom, TrustWallet, Coinbase, Binance, Exodus, TronLink, Ronin, OKX, Keplr, Rabby, Sui, Solflare. But the list doesn’t stop at the big names. It keeps going, deep into the long tail, past projects with install counts you could fit in a phone booth – ShibaWallet, xMetaCene, Elli Sui Wallet. The kind of thoroughness that suggests the list was scraped from the Web Store rather than curated by hand. Nobody sits down and types 728 extension IDs one by one. Not even a criminal.The 103 password extensions are equally comprehensive. The majors – LastPass, 1Password, Bitwarden, KeePass, NordPass, Dashlane, ProtonPass, Enpass – plus niche products like Psono, Pleasant Password Server, and heylogin. And here’s the twist: 31 two-factor authentication extensions are in the mix. 2FAAuth, GAuth, TOTP Authenticator, Akamai MFA. The stealer doesn’t just want the password. It wants the second factor too. The lock and the key and the deadbolt and the chain. Everything that stands between the victim and complete exposure.For each matched extension, the malware vacuums data from three locations: 1. <code>Local Extension Settings/</code> – the extension’s LevelDB storage 2. <code>IndexedDB/</code> – any IndexedDB databases matching the extension ID 3. <code>Sync Extension Settings/</code> – synced data, if the user has Chrome Sync enabledThe archive paths include a DJB2 hash of the browser name – <code>Wallet/Extension/MetaMask/C-Chrome-a1b2c3d4/</code> – to keep stolen credentials from different browsers filed separately. Organized crime, in the most literal sense.The full extension lists are published in the IOC repository. Defenders and extension developers can use them. Everyone else can marvel at the ambition.<h2>Harvesting a previous tool: “Underground”</h2>Early Torg Grabber builds contained code to harvest credentials from <code>C:\ProgramData\Underground</code> – a path that, at first glance, had the look of an anti-detect browser’s home directory. We spent some time chasing that theory. Turns out we were looking at it wrong. The way you sometimes look at a shadow on the wall and see a man, but when the light shifts it’s just a coat on a hook.<h3>What “underground” really is</h3>We recovered a number of&nbsp;<code>C:\ProgramData\Underground\logs.txt</code> files from infected machines. The logs told a different story. “Underground” isn’t a browser at all. It’s a standalone credential extraction tool with a two-stage architecture that bears a family resemblance to Torg Grabber’s own ABE bypass – the kind of resemblance that makes you check if they had the same father:<ol><li data-list-item-id="eaebbd3d4aa7deb4f016350202282ff88">Host process (injector) – enumerates installed browsers, creates a suspended browser process, performs reflective DLL injection, and talks to the injected payload through named pipes</li><li data-list-item-id="e0bdeb938b3bb7a840a901fe1addec28c">Injected DLL (reflective loader) – runs inside the browser process, decrypts the ABE-protected master key via Chrome’s COM Elevator service, then dumps credentials to JSON files</li></ol>The log output documents the full chain: browser enumeration, suspended process creation, ReflectiveLoader injection, named pipe setup (<code>\\.\pipe\chrome.nacl.*,&nbsp;\\.\pipe\mojo.*</code>), ABE key decryption via COM, profile enumeration, and credential extraction. It writes its take as JSON files and plaintext token files to&nbsp;<code>C:\ProgramData\Underground</code>. Neat. Professional. The kind of work that leaves receipts.<h3>What Torg Grabber harvests</h3>When Torg Grabber finds this directory – and on machines where the operators have been running their toolkit, it will – it parses three types of JSON output files left behind by the Underground tool:<ol start="3"><li data-list-item-id="e2607892443ff28f869bd1fa195fa5a42">Passwords –&nbsp;{<code>"origin":"..."</code>} objects with URLs, usernames, and passwords</li><li data-list-item-id="e0281f0bdf9f4fa2e26ba0e5c099a8086">Cookies –&nbsp;{<code>"domain":"..."</code>} objects with full cookie metadata</li><li data-list-item-id="eb155f96476575ab11879fc30506733c4">Payment cards –&nbsp;{<code>"card_number":"..."</code>} objects with card details</li></ol>It also collects three token files (<code>gaming_tokens.txt</code>,&nbsp;<code>media_tokens.txt</code>,&nbsp;<code>social_tokens.txt</code>) containing session tokens for various platforms. Double-dipping. Credentials that were already extracted once, stolen again for the archive.<h3>The connection</h3>The architectural overlap between Underground and Torg Grabber is the kind of thing that makes you sit up in your chair. Both use reflective DLL injection into suspended browser processes. Both use named pipe IPC. Both do COM-based ABE bypass. The blueprints are close enough to be cousins.But the DLL-side log strings are completely different – Torg Grabber’s&nbsp;<code>abe_decrypt.dll</code> uses&nbsp;[<code>DLL</code>] prefixed messages that don’t appear anywhere in Underground’s logs, and the host-side injector strings from Underground are absent from&nbsp;<code>abe_decrypt.dll</code>. Different binaries. Same school of thought. This rules out a shared executable but points toward a shared codebase, a common author, or tools from the same ecosystem – bought from the same shelf in the same underground marketplace.The working hypothesis: the operators who deploy Torg Grabber also ran the Underground tool on infected machines – either as a precursor or running alongside. Torg Grabber’s JSON parsers then scavenge whatever Underground left behind, like a second shift coming in to clean out what the first shift missed. This is consistent with the MaaS model: operators run multiple tools, and a good stealer picks up everything, even another tool’s leftovers.<h3>The CIS cleanup twist</h3>When the malware detects a CIS locale – Russia, Ukraine, Belarus, Kazakhstan, and the rest of the old neighborhood – it doesn’t merely skip collection. It actively deletes the entire Underground directory:

On CIS machines, this erases the Underground tool’s logs and extracted credentials – destroying evidence of the operators’ own activities. Not protecting fellow criminals’ data. Covering their own tracks. The kind of cleanup you do when you’ve been in someone’s house and you want to make sure nobody knows you were there.<h3>Gone in a day: The underground-to-ABE swap</h3>Corpus-wide analysis turned up a fact as clean and cold as a knife: Underground harvesting and the ABE bypass are perfectly mutually exclusive. Not a single sample in 139 builds contains both.<table class="table"><tbody><tr><td>Feature</td><td>Samples</td><td>Date Range</td><td>Binary Size</td></tr><tr><td>Underground harvesting</td><td>30</td><td>Dec 9 – Dec 20</td><td>265 – 525 KB</td></tr><tr><td>ABE bypass</td><td>109</td><td>Dec 22 – Feb 7</td><td>411 – 747 KB</td></tr><tr><td>Both</td><td>0</td><td>–</td><td>–</td></tr></tbody></table>The last Underground build compiled on December 20 at 15:45 UTC. The first ABE bypass build appeared 38 hours later, on December 22 at 06:32 UTC. Not a gradual transition. Not a slow fade. A clean break. One feature walked out the door and another walked in, and they didn’t even pass each other in the hallway.The logic reads like a business decision – and it was one. Once Torg Grabber gained its own built-in ABE bypass, there was no longer any need to scavenge credentials from a separate tool. The developers replaced a dependency on external tooling with native capability, the way a restaurant that used to buy bread from down the street puts in its own oven. The timing lines up with the December 22 pivot to production REST API infrastructure. Everything changed at once, because when you’re going to jump, you might as well jump with both feet.<h2>A parallel backend: /api/machine/set-files-r</h2>Three samples. Two domains. A completely different C2 protocol than the rest of the corpus, and yet the same malware framework underneath — like finding two different keys in the same man’s pocket, both opening different doors. <code>quick-neo.com</code> in December, <code>50elk.com</code> in February. This wasn’t some late experiment cooked up after the main line had settled. The quick-neo.com sample landed the same week the REST API transition began. The <code>/api/machine/set-files-r</code> backend was running in parallel from day one. Two horses in the same race, and nobody had bothered to tell the program.

<table class="table"><tbody><tr><td>Date</td><td>Domain</td><td>Backend</td><td>Size</td><td>Features</td></tr><tr><td>Dec 18, 2025</td><td>quick-neo.com</td><td>machine_api</td><td>266 KB</td><td>Underground browser, no ABE, plaintext .rdata</td></tr><tr><td>Feb 17, 2026</td><td>50elk.com (×2)</td><td>machine_api</td><td>712 KB</td><td>GRABBER_* env vars, ABE bypass, plaintext .rdata</td></tr></tbody></table>The jump from 266 KB to 712 KB — nearly triple — and the feature additions along the way — ABE bypass, env vars, string encryption — mirror the main Torg line’s evolution over the same stretch. Same playbook. Different stage. This wasn’t a dead fork. Somebody was feeding it.<h3>What they share with standard Torg Grabber</h3>The familiar framework is present across both:<ul><li data-list-item-id="ecb3e00d261e86a6cb95c41e9b031c88e">Anti-analysis: GPU-based anti-VM (EnumDisplayDevicesA against vendor blocklist), locale-based anti-CIS (GetLocaleInfoA against blocklist), Local{MachineGuid} mutex.</li><li data-list-item-id="e180593968c5d6e901e25c4c1c5a2b0af">Build tag: “grabber v1.0” – logged at startup alongside a timestamp.</li><li data-list-item-id="ed0b237a6f1f9890c06b46a4f380da80d">GRABBER_* environment variables (Feb 17 builds only): GRABBER_HOST, GRABBER_TAG, GRABBER_ANTI_SNG, GRABBER_ANTI_VM, GRABBER_STREAMING, GRABBER_HWID, GRABBER_GPU, GRABBER_SESSION – same set, same defaults (HWID → c479d3ea-cedd-43ef-af74-dc6163e5dad7, GPU → Radeon RX550/550 Series). The Dec 18 build pre-dates the env var mechanism.</li></ul><h3>What is different: The C2 protocol</h3><table class="table"><tbody><tr><td>&nbsp;</td><td>Standard Torg Grabber</td><td>machine_api builds</td></tr><tr><td>Registration</td><td>POST /api/auth with HWID, operator tag, ChaCha20 key exchange</td><td>Stubbed out – auth function returns 1unconditionally</td></tr><tr><td>Upload endpoint</td><td>/api/upload/chunk (chunked), /api/stream/*</td><td>POST /api/machine/set-files-r</td></tr><tr><td>Content type</td><td>ChaCha20-encrypted + HMAC-SHA256 authenticated chunks</td><td>Multipart form-data (boundary=----UploadBoundary9876543210)</td></tr><tr><td>Upload field</td><td>Encrypted binary stream</td><td>zip_file – raw ZIP bytes</td></tr><tr><td>Port</td><td>443 (HTTPS via Cloudflare)</td><td>443 (HTTPS, direct – no Cloudflare)</td></tr><tr><td>User-Agent</td><td>Custom ("Mozilla/5.0 ... grabber/1.0" variants)</td><td>Plain "Mozilla/5.0"</td></tr><tr><td>Error handling</td><td>Retry with exponential backoff</td><td>HTTP 200 → success; 403/400 → abort immediately</td></tr><tr><td>Archives sent</td><td>Single encrypted stream</td><td>Two separate uploads: main.zip, files.zip</td></tr></tbody></table>&nbsp;

The /api/machine/set-files-r endpoint does not match any publicly documented stealer family’s C2 protocol. A ghost in the machine, and the machine wasn’t talking.<h3>The Collection pipeline</h3>Standard Torg sends single encrypted archive; machine_api builds construct two ZIP archives with distinct folder layout:

files.zip: Additional file grabber results.The collection functions produce numbered debug log entries ([1] Creating ZIP buffer…, [2] Generating UserInfo…, etc.) — more structured than standard Torg’s free-form debug strings. The kind of organization that suggests someone was keeping score.<h3>Plaintext strings throughout</h3>Unlike the main Torg line — which progressively moved from plaintext .rdata to compiler-inlined mov immediates — both machine_api samples keep all strings as plaintext in .rdata. C2 domain, endpoint path, debug messages like “[#] Killed ALL %s processes: %d”. Everything out in the open. This branch never got the string hardening. Either they didn’t care, or they didn’t get the memo.<h3>Interpretation</h3>The quick-neo.com discovery settles the timeline. The&nbsp;/api/machine/set-files-r backend isn’t a late experiment — it’s contemporary with the earliest REST API builds. December 18 is the same day attackzombie.com samples first appeared. Two backends shipped from the same codebase on the same day. Like a man with two passports, both valid.The ten-week gap between quick-neo.com (Dec 18, 266 KB) and 50elk.com (Feb 17, 712 KB) tells the rest of the story. The machine_api line tracked the main Torg evolution: ABE bypass added, env var framework integrated, binary nearly tripled in size. Not a dead fork. Actively maintained. Parallel development, same hands on both levers.Two readings remain:<ol><li data-list-item-id="ef532baab10f732e03509e783ce1da74d">Operator-specific panel. Under the MaaS model, one customer runs a panel at /api/machine/set-files-r while the majority use the standard REST API panel.</li><li data-list-item-id="e55b3be61fa9f659eea94c15d688dc7fe">Developer’s own backend. The /api/machine/set-files-r panel is the developer’s original infrastructure, while the REST API was built for the MaaS product.</li></ol>Either way, the GRABBER_* environment variable framework and anti-analysis suite are the stable identity anchors — they persist across different C2 backends, string protection schemes, and collection pipeline layouts. The backend protocol itself is modular and swappable. The face changes. The fingerprints don’t.<h2>Conclusion</h2>Torg Grabber is a case study in velocity. Three months from prototype to production. Four exfiltration mechanisms tried – Telegram Bot API, GRAB TCP, REST API, and the parallel <code>/api/machine/set-files-r backend</code> – each one a rung on a ladder that only goes up. Eighteen C2 domains across eight registrars. A binary that nearly tripled in size while its developers were still registering the domains it would phone home to. It was like watching someone build an airplane while it was already taxiing down the runway.The Telegram breadcrumbs left behind by the early builds – bot tokens, channel metadata, and an operator whose username literally namedrops the malware’s signature encryption algorithm – provided a window into the human side of the operation. These aren’t ghosts. They’re people, with Telegram Premium subscriptions and public bios that read like job applications for a criminal enterprise.By resolving the numeric operator tags through OSINT databases, we put faces to eight of twelve MaaS customers. The faces weren’t pretty. Usernames referencing scamming (@SCAMHERE1, @scamsomebody), victims (<code>@mamontovv</code>, from “мамонт” – the mammoth, the mark, the one who showed up), suckers (<code>@lox3526tyrk</code>, from “лох” – the word speaks for itself), and stolen-credential marketplaces (<code>@scarface_logs</code> linking to <code>@NoMetaRu</code>). Four carry Telegram Premium – established actors, not disposable identities. Combined with the developer accounts recovered from the bot tokens, the picture is unusually complete. Both sides of a MaaS operation, buyer and seller, laid out under the light.The observed delivery chain tells its own story – from a ClickFix clipboard attack hosted on Google Apps Script, through a multi-stage PowerShell stager with a fake progress bar and XOR-encrypted BITS transfers, to three polymorphic MinGW loaders served from disposable .pw domains. The delivery infrastructure is as carefully engineered as the stealer itself. Strict role separation between domains – stagers on j0o.pw, encrypted loaders on t4e.pw/re3.pw, exfiltration on the main C2 cluster – provides operational resilience: burning one domain doesn’t touch the others. The use of trusted platforms (Google Apps Script, Dropbox) for initial access and server-side polymorphism for loader generation makes static blocking about as effective as putting up a “No Trespassing” sign at a public park.The family remains under active development. New C2 domains registered weekly. Builds compiled daily – 334 samples and counting, each one a fresh fingerprint. The operator base growing, 40+ tags and rising, new customers walking through the door. What initially looked like a three-day experiment with environment-variable configuration has since become the standard: every build from Feb 10 onward ships with <code>GRABBER_*</code> env var support and compiler-inlined string assignments, replacing the earlier plaintext <code>.rdata</code> approach. The most significant operational shift is the domain rotation chain (<code>gogenbydet.cc</code> → <code>bbcplay.top</code> → <code>playbergs.info</code>), where entire operator groups migrate to fresh infrastructure roughly every ten days – a cadence that makes domain-based blocking a losing game. Meanwhile, <code>evasivestars.com</code> has become a mass-build factory with date-encoded batch tags, suggesting automated deployment pipelines. We’ll keep watching. These are the kind of people who don’t stop until someone stops them.

A newly identified MaaS credential stealer evolves from Telegram exfiltration to encrypted TCP and full REST API infrastructure

Torg Grabber: Anatomy of a New Credential Stealer 

Malware authors have always understood a simple truth: defenders scale by recognizing patterns, attackers buy time by breaking them.&nbsp;For years, that meant packers, obfuscation, and classic polymorphism. In many campaigns, server-side polymorphism ensured each target received a slightly different sample, enough to blur signatures and slow down clustering, while the real investment (later-stage payloads, infrastructure, monetization) stayed steady.&nbsp;Now, we are seeing a modern version of the same strategy: Promptmorphism, the rapid regeneration of stage 1 loaders into endless fresh-looking variants. In practice, this is the loader treated as a disposable wrapper, continuously rewritten to stay ahead of similarity-based detection. In simple terms, this means attackers no longer rely only on traditional code mutation. Instead, they can use AI prompts to repeatedly generate new versions of the same loader, creating a steady stream of slightly different files that all perform the same job.&nbsp;To be clear, not every fast-changing loader is LLM-written, some are driven by template engines, build pipelines, or manual refactors. What has changed is how easy LLMs make high-frequency rewrites at scale, especially for small, modular first-stage components.&nbsp;<h3>What we mean by Promptmorphism&nbsp; &nbsp;</h3>Promptmorphism is LLM-assisted code variation used to continuously regenerate the early-stage loader, producing many distinct implementations of the same minimal job. Because LLMs are probabilistic models, unless outputs are tightly constrained, small prompt or sampling changes naturally produce different implementations of the same logic, variation becomes the default rather than the exception.&nbsp;Stage 1 rarely needs to be clever. It needs to run, perform a few checks, then fetch, decrypt, unpack, or hand off to stage 2. That narrow scope makes it ideal for rapid rewriting. An LLM can re-express the same logic with different structure, different API usage, different control flow, and different naming conventions, without changing the campaign’s underlying playbook.&nbsp;From a defender’s perspective, this matters because stage 1 is what you encounter first. It is the component most likely to be scanned, sandboxed, executed, and shared. If that component can be churned endlessly, workflows that rely heavily on static similarity and quick clustering lose leverage.&nbsp;

<h3>A real-world example: a LaaS “packaging roulette”</h3>To make this concrete, here’s what this looks like in the wild.We are tracking a loader-as-a-service (LaaS) ecosystem where multiple campaigns rely on a shared loader that is frequently updated and redistributed. We have seen the same loader layer used to drop different malware, including Wincir and Stealc.What is striking is not just that the loader changes; it is how fast it changes. Over a short span of days, we observed the same stage 1 job implemented with a rotating set of packaging choices:<ul type="disc"><li data-list-item-id="e2726bbacc59a47e7cc5196151e3632ce">Encrypted payload embedded in the executable, with keying material present alongside it.</li><li data-list-item-id="e243bca6bd708acaf9e1516c7570fcf0b">A shift to hex-encoded payloads.</li><li data-list-item-id="e3d909c138c86b09a0626deebf3d97cb1">Then multiple hex-encoded chunks (for example, 10 parts) that had to be assembled at runtime.</li><li data-list-item-id="ec02244e38543f8cc10f1e0dd4ee3fedf">A return to raw encrypted bytes embedded directly in the executable.</li><li data-list-item-id="ece89b03e3f39e29ef7e799c7cbb858e4">Moving encrypted bytes into the PE overlay (data appended beyond the formal end of the PE image).</li><li data-list-item-id="ecd6c43a00f4894fe776d49e8ad394d0a">Placing encrypted bytes inside x64 code itself, effectively blending “data” into executable regions.</li><li data-list-item-id="e018a914e3e8d096c98a97e155fc5169b">In at least one iteration, swapping cryptography (for example, ChaCha instead of AES).</li></ul>The key takeaway is that the mission stays broadly the same, but the wrapper changes repeatedly. If you have ever dealt with server-side polymorphism, this will feel familiar. The difference is that the source of variation is no longer only classic packing and obfuscation transformations&nbsp;and encryption wrappers. Increasingly, the operational goal is achieved via rapid rewrite cycles, whether driven by LLM assistance, aggressive refactoring, or automated build pipelines designed to mutate the first stage.<h3>Why stage 1 is the perfect target for this approach</h3>Stage 1 is exposed. It has to survive the widest range of defensive controls (gateway scanning, reputation systems, endpoint scanning, sandboxing). It also tends to be modular, which makes it easier to swap.In the Wincir chain, analysis shows a loader that includes multiple capabilities common in modern staging:<ul type="disc"><li data-list-item-id="e5fedfdbf81ef4bb4cf1218021ba4abac">decryption and decompression routines</li><li data-list-item-id="eb63f7db44a54416ae48d419d8029644b">API resolution and loader scaffolding</li><li data-list-item-id="e9c690a2461baf1b5e0ee4b6f58858a31">injection and execution plumbing</li><li data-list-item-id="e88eab72f7c1378e9b9da2753bd9c398a">anti-analysis checks</li><li data-list-item-id="e735a9629325ff7a9e68b8e72cbb95d14">network retrieval for follow-on components</li><li data-list-item-id="ecee60024174fd37c8eb6bc0428b685b0">in some samples, script-host execution paths (for example via Windows script engines)</li></ul>This is exactly why attackers focus mutation here. If stage 1 buys them a few extra hours or days before defenders build durable clustering and detections, the rest of the chain gets to run.<h3>How Promptmorphism differs from classic server-side polymorphism</h3>It is tempting to label all of this “polymorphism,” but there is a meaningful difference between transforming an artifact and re-authoring one.<ul type="disc"><li data-list-item-id="ef4193c5eef015653a5ab33dd042ade53">Server-side polymorphism often starts with the same logic and changes representation (packing, encryption layers, stub transformations).</li><li data-list-item-id="e26b4d8f2ec6385e877ed0425fda2bd25">Promptmorphism can change the implementation itself, reorganizing code structure, swapping APIs, rewriting helper logic, and reshaping control flow, while preserving behavior.</li></ul>In practice, this can reduce obvious byte-level similarity and break simple clustering. At the same time, it introduces new seams: if attackers lean on the same generation patterns, prompts, or scaffolding, they can accidentally create a different kind of fingerprint.<h3>The attacker tradeoffs, this is not magic</h3>It is useful to be skeptical of the “AI makes malware unstoppable” framing. Promptmorphism creates pressure, but it also creates friction for attackers:<ul type="disc"><li data-list-item-id="e7970a7f1f532c818c34e57e1a6d7b097">Quality varies, rewrites introduce bugs.</li><li data-list-item-id="ebfca458e3a3ea82f9b3b8288f822abbf">Consistency drops, which can hurt reliability across environments.</li><li data-list-item-id="e14de79ac7b6f36d18b65ec06c536ca66">Noise increases, rewritten code often adds unnecessary behavior or sloppy error paths.</li><li data-list-item-id="ec3611852372e6b9d6483291368ede1b9">Stable anchors become more important, because defenders shift focus to what does not change.</li></ul>A useful way to frame it is this: Promptmorphism shifts the battleground. It does not eliminate detection; it pressures defenders to pivot from “what does this file look like” to “what does this campaign do.”<h3>How defenders should respond when stage 1 becomes disposable</h3>When the loader is unstable, the durable signals are usually elsewhere:<ul type="disc"><li data-list-item-id="ec5edafdd9bd6401a501b9f57ae0100a4">Behavioral anchors: process tree patterns, persistence choices, execution handoff, network call sequences.</li><li data-list-item-id="eac0d9ff58060a011c47a3815ad79af25">Campaign correlation: infrastructure reuse, endpoint patterns, TLS/HTTP fingerprints, timing and targeting patterns.</li><li data-list-item-id="e091d6a05e49e8a129e05c5b63f1d3054">Chokepoints: second-stage retrieval, config formats, decryption and decompression routines that remain consistent across waves.</li><li data-list-item-id="e93d996af05db9dc6fe891e023cd1d093">Distribution signals: delivery channels, lures, attachment styles, redirect chains.</li></ul>Stage 1 can be rewritten. The campaign economics, infrastructure constraints, and operational habits are harder to rewrite every day.<h3>Closing Thought</h3>Promptmorphism is not just “AI malware.” It is a sign of industrialization.Attackers have always chased cheap novelty. Promptmorphism is a new production method for an old business goal: keep the front door unstable long enough to get inside.Defenders can respond by refusing to treat stage 1 as the “identity” of the threat. When the loader becomes disposable, the campaign becomes the unit of analysis, and that is where durable defenses and durable disruptions are won.

 How malware authors use LLM‑driven “promptmorphism” to endlessly reshape loaders—and what defenders must do to keep up 

Promptmorphism: How LLMs Are Mass-Producing Disposable Stage 1 Loaders 

We leverage the strength of our global team, knowing we’re more powerful together. Read news about Gen's company activities and initiatives.

Company News

Gen has a family of trusted consumer brands that for decades have helped people stay safe in the digital world. We pride ourselves in the trust we’ve built with people around the world to navigate the latest technology safely and with confidence. And that’s exactly why we recently launched the Gen Agent Trust Hub – our trust layer for the agentic AI ecosystem.AI agents are no longer theoretical. They are here. They are editing files, installing packages, calling APIs, connecting to MCP servers, spawning sub-agents, persisting memory, and executing real workflows across environments. This shift from passive AI to autonomous execution fundamentally expands the attack surface.The Agent Trust Hub (ATH) exists to meet this moment. It is designed to provide continuous protection across the full lifecycle of an AI agent – from identity and verification to runtime enforcement. But security at this scale cannot rely on proprietary guardrails alone. It requires shared foundations the industry can build on.To help establish that foundation, we created the AI Agent Safety Standards by Gen to serve as a unified framework designed to bring consistency, portability, and accountability to agentic systems. This framework is currently built on two complementary pillars:<ul type="disc"><li data-list-item-id="e464ce0354d35c1a986c83945bc06b0cd">AI Agent Runtime Safety Standard (AARTS) – an open standard for runtime decision enforcement across agent hosts</li><li data-list-item-id="e4a7d4ceb7039019b7c2554401a8bb1c3">Skill IDs – a deterministic, content-addressable fingerprinting system for AI agent skills</li></ul>Together, they enable the ATH and the broader agentic AI community to enforce trust not just within one environment but across the broader agentic ecosystem. &nbsp;Let’s dig into the details.&nbsp;<h2>Pillar One: Standardizing Runtime Safety for AI Agents</h2><h3>AARTS</h3>AI agents operate across a fragmented ecosystem of IDEs, orchestrators, frameworks, and standalone applications. Each host defines its own lifecycle events, security hooks, and enforcement logic.This fragmentation creates blind spots. A security engine integrated into one host may lack context or control in another, even when the risks are identical.AARTS&nbsp;addresses this gap. It is not a product. It is a vendor-neutral contract that defines:<ul type="disc"><li data-list-item-id="e226fc797549b56b0ae0a537923fd79f6">Where security decisions can be made (hook points)</li><li data-list-item-id="e7566ceb595a0278da9453bbd84659578">What data is available for evaluation (data model)</li><li data-list-item-id="e637f36bcc4e8dcfac7321ad59230c1c1">How decisions are enforced (verdict semantics)</li></ul>Simply put:&nbsp; AARTS standardizes runtime security decision-making across agent hosts.<h3>The Architecture</h3>AARTS defines three cleanly separated roles:<ol><li data-list-item-id="e7a445b9a896b9b89299afa17ca58c69e">Host Runs the agent, emits lifecycle events, and enforces decisions.</li><li data-list-item-id="e989b722cd161ff069c924d70571cd6b7">Adapter Maps host-native events into a standardized AARTS schema.</li><li data-list-item-id="ed862f4398b4b82c3b52c721801728a9c">Security Engine Evaluates events and returns structured verdicts.</li></ol>This separation prevents superficial “checkbox security” while preserving portability. Hosts provide the right context at the right time. Engines make decisions without depending on host internals.In ATH, this architecture allows enforcement logic to remain portable while enabling hosts to integrate in a predictable way.<h3>Hook Points: Where Safety Happens</h3>AARTS v0.1 defines 19 hook points across the agent lifecycle, including:<ul type="disc"><li data-list-item-id="ec5255705352d810833f77d79b310a42d">PreToolUse — evaluate shell commands, file writes, web requests, package installs</li><li data-list-item-id="ee1ebbdf3e4522a59dedaa55c0305d903">PreLLMRequest — protect prompt integrity and instruction layering</li><li data-list-item-id="e10ef155bfe4c584afd7492da267796be">PreSkillLoad / PrePluginLoad — enforce supply chain controls</li><li data-list-item-id="ee6184f1048dfbf4ee3c0e62c2d3dff16">PreMCPConnect — treat MCP connections as trust boundaries</li><li data-list-item-id="ebc57267bf0e891e01f9daf277ced1a01">PreMemoryRead / PreMemoryWrite — protect persistent memory</li></ul>These hooks enable consistent policy enforcement regardless of whether an agent runs in an IDE, CLI, or orchestrator.Verdict Semantics: Allow, Deny, AskAARTS engines return structured verdicts:<ul type="disc"><li class="ck-list-marker-bold" data-list-item-id="e9615d2d55e251652e73363c052de0bd1">Allow</li><li class="ck-list-marker-bold" data-list-item-id="eb510a0ee27b0a853b90ff01cec91953d">Deny</li><li class="ck-list-marker-bold" data-list-item-id="ed6e8c58ce99af62dddbf6b530bc0c83c">Ask</li></ul>Each verdict includes severity, threat category, optional confidence scoring, and human-readable reasoning.Importantly, AARTS enforces deterministic behavior:<ul type="disc"><li data-list-item-id="edfce7cb3a277e1da6e442c971f8cc8e1">If a host cannot support interactive “Ask,” it defaults safely to Deny</li><li data-list-item-id="ec790330b39c695d6cdacf4118e106c1b">If an engine fails, hosts fail-open and log explicitly</li></ul>These operational tradeoffs are intentional. Predictability is essential in security infrastructure.<h3>Why AARTS Matters</h3>Without a shared runtime contract:<ul type="disc"><li data-list-item-id="e2574817ec2bfc1a1b0233c5fca970994">Security integrations are bespoke and brittle</li><li data-list-item-id="ebbe5c354debe741cc08436719a34032e">Tool taxonomy is inconsistent</li><li data-list-item-id="e2f498a30e5d748e37c3176b169145707">Prompt injection controls vary by host</li><li data-list-item-id="e3aff5387909fd85f523c40998fdb13b0">Supply chain risk is unevenly enforced</li></ul>With AARTS:<ul type="disc"><li data-list-item-id="eaa8f402b20b740f0992dd0f9b4f42b44">One engine can operate across multiple hosts</li><li data-list-item-id="e3ddcda4fa65f1abd066be4b0bef0201b">Policies remain portable</li><li data-list-item-id="e5ec3076209374ae5eafb39a00f19adf4">Audit logs become comparable</li><li data-list-item-id="e6f17fa0cc0a6a6e0136b63569cdc58a6">Trust boundaries are explicit</li></ul>AARTS standardizes enforcement in the agentic world.To read the full technical breakdown, see the full AART&nbsp;<a href="https://www.gendigital.com/blog/news/company-news/ai-agent-runtime-security">technical blog post</a>. To comment on the standards, visit our page on&nbsp;<a href="https://github.com/gendigitalinc/aarts">GitHub</a>.<h2>Pillar Two: Skill IDs</h2><h3>Fingerprinting AI Agent Skills</h3>AI agents are extended through skills – directory bundles containing a SKILL.md prompt file alongside scripts, templates, configuration, and documentation.These skills function like plugins. Install one, and the agent gains new capabilities.But skills are not single files. They are directory trees.And directory trees are notoriously difficult to fingerprint reliably.<h3>The Identity Problem</h3>A naive SHA-256 hash of a ZIP file does not work:<ul type="disc"><li data-list-item-id="e6fc83ba16d130bd7d3d62ba2af79f96d">ZIP files are non-deterministic</li><li data-list-item-id="ee7939e0ca570cb480cbdc5b8e5460ece">Timestamps vary</li><li data-list-item-id="e5d398fbba0c41d53d0e3782902bce4c1">Entry order differs</li><li data-list-item-id="e95611c8e95e6ad4f16eccdede99ac42c">Unicode normalization differs across OS platforms</li><li data-list-item-id="ef8771bdef58d5438cc192edc36e89c56">Wrapper directory names vary</li></ul>Two identical skills can produce different ZIP hashes.That is unacceptable for security workflows.<h3>Designing the Skill ID</h3>Skill IDs solve this problem by creating a deterministic, content-addressable identifier for a skill’s logical directory tree.The algorithm:<ol><li data-list-item-id="ebdc8f7c1fc531f4ccbd79f2baf7b6d83">Extract all files and directories</li><li data-list-item-id="e06cf4d178c29a57575a249d22d5cb9b4">Normalize paths (slashes, Unicode NFC, dot components)</li><li data-list-item-id="e69f139d48a1c91815267ffb649c74e07">Strip wrapper directories</li><li data-list-item-id="e07c1da87b4b07a634d73a79ab93f9134">Hash each file individually (SHA-256)</li><li data-list-item-id="ef7cb735107df0cafdbcc921e639c0212">Build sorted tree entries using null-byte delimiters</li><li data-list-item-id="eab8b3782aab3b4dd9b0f4aed3255caf8">Hash the tree to produce the final Skill ID</li></ol>The result is a 64-character SHA-256 digest that changes if and only if meaningful content changes.Same content, different ZIP packaging? Same ID. One byte changed? Different ID.This mirrors git’s tree hashing model and decades of security best practices.<h3>What Skill IDs Enable</h3>A stable identity primitive unlocks established security workflows:Allowlisting Approved skills can bypass repeated analysis.Content-addressable storage Deduplicate identical submissions automatically.Per-file caching Reuse expensive AI analysis on unchanged files.Detection flagging Connect file hashes to reputation systems.Version tracking Content becomes the version boundary.Skill IDs provide identity before verdict.<h3>From Identity to Authenticity: Signing Skills</h3>Identity answers “what is this?”Authenticity answers “who published this?”We are exploring a signing model inspired by Authenticode:<ul type="disc"><li data-list-item-id="e2103c63753a0f24a87fa144d75611c7a">A skill.sig file embedded inside the directory</li><li data-list-item-id="e28e6643465e0cabeea54eb4bc5302028">Excluded from the Skill ID calculation</li><li data-list-item-id="e700fd96bf7f3d0db4aa70df0a92d57ec">Contains a signature over the Skill ID</li><li data-list-item-id="ea2483e766cae2defa9d2dd19707d9302">Verifiable against the author’s public key</li></ul>This enables:<ul type="disc"><li data-list-item-id="eddf73c0b79d7d482c030736b4f449be8">Author signing</li><li data-list-item-id="e3d708097518f6e38a31a73aaf27ecb49">Marketplace attestation</li><li data-list-item-id="e81ca5157252eece76405ff632c0d6722">Certificate chains</li><li data-list-item-id="efe336aa9f477f99f141fc5a81f887d9b">Revocation workflows</li></ul>Self-verifiable skills create accountability without external lookups.To read the full technical breakdown, see the full <a href="https://www.gendigital.com/blog/insights/research/ai-agent-skill-fingerprinting" target="_blank" rel="noreferrer noopener">SkillsID technical blog post</a>. To comment on the standards, visit our page on <a href="https://github.com/gendigitalinc/skill-id-standard">GitHub</a>.&nbsp;<h2>The AI Agent Safety Standards by Gen: Identity + Enforcement</h2>AARTS governs runtime enforcement. Skill IDs govern artifact identity.Together, they form the foundation of the AI Agent Safety Standards.<ul type="disc"><li data-list-item-id="ea3ef208939f34e4fcfaf98bd8e26b2d6">Skills can be uniquely identified, versioned, and signed.</li><li data-list-item-id="e30dceebd279e7a291dc71a82c7168ab2">Runtime actions can be evaluated consistently across hosts.</li><li data-list-item-id="e1a7b0d4259c4abb5e6ba2f38dffd6aaa">Supply chain trust and runtime enforcement operate under shared semantics.</li></ul>This is the same model that matured endpoint security over decades:<ul type="disc"><li data-list-item-id="ebacb70fb4a6565c103650a6c6ee67532">File hashes</li><li data-list-item-id="ed254dd1eec0c62e2aea6bce82e871995">Content signatures</li><li data-list-item-id="e37a3133a17b4a1adca017b868990baa6">Runtime enforcement</li><li data-list-item-id="eeeb5f5d7a84badb31f60600269d24edf">Portable policy engines</li></ul>We are applying those proven patterns to a new artifact type and a new execution model.<h2>Looking Ahead</h2>These standards are early. AARTS v0.1 is a draft. Skill ID signing is an evolving proposal. Adapter conformance testing, enterprise fail-open profiles, and cross-marketplace reputation sharing remain active areas of collaboration.But the direction is clear.AI agents are moving from experimentation to infrastructure. Security must do the same.The Gen Agent Trust Hub is our contribution to building a predictable, interoperable trust layer for the agentic ecosystem.&nbsp;We invite host builders, marketplace operators, enterprise security teams, and fellow security vendors to review, adopt, and challenge.Because in the agentic era, safety cannot be bespoke. It must be foundational.&nbsp;

Shaping the standards for a safer, freer Agentic Era 

Leading the Way for AI Agent Safety 

Director of Threat Research & Applied AI

We built a security engine that protects AI agents across several major platforms. The hardest part wasn't building the protection. It was discovering that each platform exposes different security-relevant events, provides different context about what the agent is doing and why, and enforces security decisions differently. The same agent action we can catch and block in one platform is invisible in another, not because our detection failed, but because the platform never told us it happened. There are now over a dozen agent platforms, from IDE assistants like Claude Code, Cursor, and GitHub Copilot, to agentic frameworks like LangChain, CrewAI, and OpenAI Agents SDK, to orchestrators like n8n, and each one handles this differently, if at all.Today, Gen is releasing AI Agent Runtime Safety Standard (AARTS) as part of its Agent Trust Hub initiative, which aimsto address this fragmentation. This is not a security product, but rather a set of vendor-neutral standards that connects agent hosts (IDEs, orchestrators, frameworks, standalone agent apps), security engines (components that evaluate agent actions), and adapters (thin mappings that translate host-native events into a common schema). For those building or operating agents, AARTS enables portable, consistent security decisions across hosts, eliminating the need to rebuild security integrations from scratch.&nbsp;The standard is open and vendor-neutral, and any host or security vendor can implement or contribute to it.<h2 class="text-align-justify">The Problem AARTS Addresses</h2>Agentic systems fail in ways that are familiar but occur more rapidly and with greater reach. Examples include sequences evolving from helpful actions to dangerous activities like&nbsp;"download and execute," prompt injection steering tool use, supply chain issues affecting skills and plugins, sensitive data exposure by agents, and permission confusion resulting from sub-agents and external tool providers creating additional trust boundaries. Although these risks are not new, they now manifest within a rapidly diversifying set of hosts and tool APIs.Without a shared contract, security becomes a collection of one-off integrations, each missing context and offering inconsistent enforcement. This leads either to weak coverage, due to incomplete integrations and context, or to overly blunt blocking when trust is undermined by limited interpretation. AARTS targets the root cause: the lack of shared semantics and hook points.In our previous&nbsp;<a href="https://www.gendigital.com/blog/news/company-news/ai-agent-detection-and-response" target="_blank">post on Agent Detection and Response</a>, we described how attackers register AI-hallucinated package names on npm and PyPI, preloaded with infostealers. Catching that requires seeing the package install action with enough context — the package name, the source, whether the agent hallucinated it or the user requested it. One platform gives us all of that. Another gives us the command string with no structured metadata. A third doesn't emit the event at all. Same attack, three different levels of visibility.Simply put, AARTS standardizes where security decisions can be made (hook points), what data is available for decision-making (data model), and how decisions are enforced (verdict semantics), ensuring consistent protections across different agent hosts.<h2 class="text-align-justify">Architecture and Roles</h2>AARTS defines three distinct roles:<ul type="disc"><li data-list-item-id="ef43f78807d68ed5d7cafc41e43ed6a77">Host: The environment that runs the agent. The host emits lifecycle events at defined hook points and enforces decisions.</li><li data-list-item-id="ea8ecfedda9151e1e4ff45954fc0bd003">Adapter: A minimal translation layer that maps host-specific events into AARTS events, normalizing tool names, lifecycle phases, and context.</li><li data-list-item-id="ec84e412023baa1359b60a4c189c0ce73">Security Engine: The evaluator that receives AARTS events, applies detection strategies, and returns structured verdicts.</li></ul>This separation matters. Embedding security logic in hosts results in superficial security ("checkbox security"), while engines depending on host internals compromise portability. AARTS keeps the boundary clean: hosts provide the right moments and context, and engines make decisions. AARTS also supports various integration models (in-process, subprocess, remote), accommodating different latency, isolation, and operational requirements.<h2 class="text-align-justify">How the Standard Works</h2>AARTS defines hook points, moments in an agent's lifecycle where a security engine can intercept, evaluate, and act. Version 0.1 specifies 19 of them across session management, prompt lifecycle, tool execution, plugin and skill loading, sub-agent behavior, memory operations, and output delivery.Not all hooks carry equal weight. Three illustrate the design logic:<ul type="disc"><li data-list-item-id="e9e499b9374a4cd1f71378518f359c0d6">PreToolUse is the primary checkpoint. Before an agent runs a shell command, writes a file, makes a network request, or installs a package, the security engine sees the action, its arguments, and the context that led to it, then returns a verdict: allow, deny, or ask the user. This is where most real-world threats get caught.</li><li data-list-item-id="ebd37c3ab71aca6ef9cddd1080d793f75">PreLLMRequest operates earlier in the loop, before the prompt reaches the model. It lets engines inspect prompt integrity: whether safety instructions survived context compaction, whether untrusted content was injected into the conversation, whether the instruction layering is intact. If PreToolUse is the checkpoint at the door, PreLLMRequest watches for problems before the agent even decides what to do.</li><li data-list-item-id="ecce291342cb701e4290928d827faf930">PreSkillLoad addresses supply chain risk. When an agent installs a plugin or skill from a marketplace, the engine can evaluate the trust source (where it came from, whether it's signed, whether it was modified) before it gets loaded. AARTS can also direct the host to strip hooks from skills, preventing plugins from disabling the security layer that's supposed to govern them.</li></ul>The remaining 16 hooks follow the same pattern: they sit at the moment where risk becomes real and provide the engine with enough context to make a decision.For those decisions to be portable across hosts, the inputs have to be consistent. AARTS standardizes the event structure: every event carries a mandatory envelope (hook point, session ID, timestamp, host identity) plus standard extensions, reusable field groups for conversation context, tool details, trust source metadata, modification tracking, and provenance. A canonical tool taxonomy maps host-specific tool names (Cursor's "terminal" vs. Claude Code's "bash") to common categories (shell, file_write, web_request, package_install), so detection logic written once works everywhere.Verdicts are structured: a decision (allow, deny, or ask), a threat category, a severity level, confidence, and a human-readable explanation for the user. Two design choices are worth noting. If the host can't prompt the user, ask falls back to deny, safe but a real constraint for headless orchestrators. If the engine crashes or times out, the host treats it as allow and logs the failure. Fail-open is the right default for developer tools where latency matters, but enterprise deployments will want to revisit this per environment.<h2 class="text-align-justify">Conformance Levels: Gradual Adoption</h2>AARTS defines three conformance levels:<ul type="disc"><li data-list-item-id="e18c7418214ef4f97b683f20402deb227">Level 1 (Basic): Requires SessionStart and PreToolUse hooks, minimum tool coverage (shell, file_write, web_request), enforcement of allow and deny (ask may be treated as deny).</li><li data-list-item-id="e0369d9837c299bdfd5a5c490fb899318">Level 2 (Standard): Adds plugin and skill load hooks, prompt lifecycle protection, broader tool coverage, additional hooks (PrePluginLoad, PreSkillLoad, PostInputProcessing, PreLLMRequest, PostToolUse), and requires provenance on PreToolUse.</li><li data-list-item-id="e31f70f735daa583aec2ef8c2d180686d">Level 3 (Comprehensive): Provides full lifecycle coverage including user input, prompt response cycle, tool modification, sub-agents, MCP connect, memory read/write, output delivery, and session end. Clarifies sub-agent inheritance and memory protection.</li></ul>This tiered approach offers a realistic adoption path: Level 1 addresses basic failures, Level 2 tackles prompt integrity and supply chain issues, and Level 3 supports persistent and autonomous agents.<h2 class="text-align-justify">Open&nbsp;Considerations</h2>As we move AARTS beyond a draft specification,&nbsp;the following are being considered:<ul type="disc"><li data-list-item-id="ef56e3529222a5671c75f8e80fbc5c2c9">Enterprise fail-open story: The spec mandates fail-open behavior. Deployment profiles may be needed to reflect the realities of different environments.</li><li data-list-item-id="e5e2beee0ceee16ba315173c83dcc4596">Adapter integrity: Ensuring adapters correctly map tool types and extract artifacts is vital. A conformance test suite for adapters is as important as the specification itself is a next-step priority.</li><li data-list-item-id="eea2912c8ee60ab64a8339e4d3c2b5748">Consent for privacy: Explicit consent is required for external transmission of prompts and tool data. Operational guidance or recommended patterns are needed to avoid incompatible implementations.</li><li data-list-item-id="e7dbd49139e599330dbad43c59209bc82">Ask semantics in headless environments: Treating ask as deny by default is safe but may discourage engines from using ask. A standard way for deployment policy to handle ask in these scenarios is needed.</li></ul>AARTS aims to translate&nbsp;these considerations into predictable operational behavior.<h2 class="text-align-justify">Call for Feedback</h2>AARTS v0.1 is a draft intended for early review by host builders, security vendors, and enterprise operators.&nbsp;The full specification is available <a href="https://github.com/gendigitalinc/aarts" target="_blank">here</a>. If you build agent hosts, consider whether you want every security integration to remain one-off. If you develop security engines, ask yourself whether you want to rewrite the same logic for each host and still miss critical context. AARTS aims to make the answer “no”.&nbsp;We welcome contributions — open an issue or submit a pull request.

AARTS standardizes how AI agent platforms expose security events, enabling portable runtime protection across the growing agent ecosystem

Introducing AARTS: An Open Standard for AI Agent Runtime Safety

You gave an AI agent access to your computer. Maybe it's writing code for you, managing your emails, or handling your finances. It's working with your credentials, acting on your behalf, and making decisions you used to make yourself. Fast, confidently, and largely unsupervised. That's the deal: you trade safety and oversight for productivity. That changes the security model.But who's watching what it actually does?That is why we built the Gen Agent Trust Hub (ATH), our trust layer for the agentic AI ecosystem, designed to secure agents across their lifecycle from skill to runtime to enforcement.Agent Detection and Response (ADR) is the runtime pillar — the layer that governs what agents actually do.<h2 class="text-align-justify">What is ADR?</h2>ADR intercepts agent actions at the moment of execution, before they land, and evaluates whether they're safe. It allows, asks the user, or denies. That's the core.Verification tells you what an agent is. ADR tells you what it's doing. These are complementary. Verification is necessary, but it can't govern what happens at runtime. A verified skill can still hallucinate a malicious package name. A signed plugin can still be exploited through prompt injection. A trusted agent can still lose its safety instructions mid-session and go off the rails. The moment of action is where risk becomes real.The principle isn't new. Every major computing paradigm has developed its own detection and response layer. Endpoints got EDR. Distributed infrastructure got XDR. Not replacements for what came before, but purpose-built layers for new execution surfaces with new threat models. AI agents are the next such surface, and ADR is the layer built for it.Within the Agent Trust Hub, ADR is the enforcement engine that turns trust signals into real-world protection.<h2>Why Now?</h2>The threats targeting AI agents are already here. What follows is a small sample of the agentic threats we’re seeing. The actual attack surface spans everything an agent can do, and agents can do a lot.Your agent installs malware for you. AI agents hallucinate. When they hallucinate a package name during installation, that's not just an error, it's an opportunity. Attackers monitor AI-suggested package names and register them on npm and PyPI, pre-loaded with infostealers and backdoors. The technique is called slopsquatting, and it's already being exploited at scale. In February 2026, researchers uncovered a campaign of&nbsp;<a href="https://www.securityweek.com/new-sandworm_mode-supply-chain-attack-hits-npm/">19 typosquatted packages specifically</a> targeting users of AI coding tools, designed to exfiltrate SSH keys, AWS credentials, and API tokens.Your agent ignores your instructions. Summer Yue, Meta's Director of Alignment, told her OpenClaw agent to&nbsp;<a href="https://techcrunch.com/2026/02/23/a-meta-ai-security-researcher-said-an-openclaw-agent-ran-amok-on-her-inbox/">confirm before taking any action</a> on her email. It worked, until the session ran long enough to trigger context compaction, a mechanism where the agent compresses its memory to keep running. The safety instructions were among the first things dropped. The agent deleted 847 emails. She had to physically run to her machine to stop it.Your agent is a new delivery channel for malware. Attackers are already using multiple paths to get malicious code running through agents. Weaponized skills on public marketplaces have delivered the&nbsp;<a href="https://x.com/GenThreatLabs/status/2018323584834318419">AMOS infostealer to macOS users</a>. Malicious project configurations have achieved&nbsp;<a href="https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/">remote code execution in Claude Code</a> the moment a developer opens a repository. Prompt injection through fetched content can turn a trusted agent into an attacker's proxy. The delivery mechanisms vary. The result is the same: your agent executes something it shouldn't, and it does so with your permissions.These are just three examples. The pattern is consistent: agents operate with real authority, and that authority is being exploited. Through supply chains, through the agent's own fragility, and through the same malware ecosystem that has targeted every other computing platform before them.<h2>Where ADR Must Operate</h2>To be effective, ADR must sit as close to the agent's execution loop as possible. Not as an external service watching from the outside. Inside, where the actions happen.Agent sessions contain source code, credentials, business logic, and personal data. ADR evaluates locally, on the device. No prompts, tool inputs, or code leave your machine for analysis.Agents are not robust systems. Their own internal mechanisms can silently drop safety instructions or get poisoned across sessions. A security layer that only sees inputs and outputs misses the moment things go wrong inside. ADR watches the execution loop itself: every action the agent attempts, in context, in sequence.Only a client-side layer sees the complete picture: the prompt history, what files were already modified, the sequence of prior actions. A remote service sees isolated events. ADR sees the session. That difference is what makes it possible to distinguish a legitimate file deletion from a compromised agent cleaning up its tracks.<h2>Sage: ADR in Practice</h2>In February, we&nbsp;<a href="https://www.gendigital.com/blog/news/company-news/sage-ai-agent-security">open-sourced Sage</a> as the first implementation of ADR. It runs client-side, directly inside the agent's execution loop, across Claude Code, Cursor, and OpenClaw. Over 200 detection rules cover supply chain attacks, credential exposure, dangerous commands, persistence mechanisms, and more, backed by Gen's threat intelligence.Since launch,&nbsp;<a href="https://github.com/avast/sage/">Sage</a> has quickly crossed 1,000 installs and is available across the major agentic tool marketplaces. The open-source community is already contributing, porting Sage to new platforms like OpenCode and hardening detection rules. As one independent security researcher concluded after&nbsp;<a href="https://www.linkedin.com/pulse/paranoid-sage-testing-security-tool-agents-radek-hendrych-capff/">testing Sage</a>: "Real-time monitoring and management of AI agents based on deterministic measures is, in my view, the right way to go."All these responses confirm what we suspected: people want this layer.<h2>What's Next</h2>ADR is the runtime layer. But runtime protection alone isn't enough.&nbsp;The Agent Trust Hub is built on the idea that trust in the agentic era must be layered: verification before installation, ecosystem trust signals across marketplaces, and enforcement at execution. ADR closes the gap at the moment risk becomes real.&nbsp;The industry needs a common interface for how agents expose their actions to security tools. A shared standard, so that protection works consistently regardless of which agent you use or which platform you're on. We've been working on that too. More soon.

Inside the Gen Agent Trust Hub, ADR turns trust signals into real-world protection.

Gen Agent Trust Hub Introduces Agent Detection and Response: The Missing Security Layer for Agentic AI 

AI agents are starting to do the parts of computing that used to be “hands on keyboard”. They run terminal commands, edit files, install packages, and fetch things from the web, because that’s what it takes to get real work done. Tools like Claude Code, Cursor, and OpenClaw give these agents direct access to your machine and your sensitive information. That's what makes them useful. It's also what makes them risky. These agents make mistakes. They install packages that don't exist because they hallucinated the name. They pick up credentials and pass them where they shouldn't. They'll download and run programs from the internet without a second thought if the task seems to call for it. All of this happens fast, with confidence, and without asking. If you’ve watched an agent confidently suggest curl … | bash or “just add your API key here” into a file it shouldn’t touch, you’ve seen the problem.&nbsp;Agents are also targets. Malicious URLs, poisoned dependencies, and compromised plugins can turn an agent into an attack vector, one that already has access to your files, your terminal, and your network. This is already happening. <a href="https://x.com/GenThreatLabs/status/2018323584834318419" target="_blank" rel="noreferrer noopener">We recently identified</a> around 400 malicious skills on ClawHub, a public registry for agent extensions. At the time of discovery, they accounted for 12% of all available skills. These weren’t obviously shady throwaways; many were weaponized versions of legitimate skills, designed to trick agents into downloading malware.&nbsp;&nbsp;These are the same agents we're starting to trust with payments, infrastructure, and sensitive workflows. The gap between what agents can do and what keeps them in check is real, and it's growing.&nbsp;Today, Gen, the company behind Norton, Avast, LifeLock, and AVG, is releasing Sage to close that gap. With Sage, the Agent Trust Hub now evaluates and governs agent behavior during execution. Not just before installation. Not just at verification. But in the exact moment an action is about to happen.&nbsp;

<h2>What Sage does</h2>Think of Sage as a lightweight safety shield for AI agents. It sits inside the agent's workflow and checks every action before it happens: shell commands, URL fetches, file writes, package installs. For each action, Sage returns a verdict:&nbsp;<ul type="disc"><li data-list-item-id="e2aee30f293d4edf72390d310cdfa3f0e">Allow — no threat detected, the action proceeds&nbsp;</li><li data-list-item-id="e89d49ae9fae752dee97f089112c466b8">Ask — something looks suspicious, the user decides&nbsp;</li><li data-list-item-id="e44ca3f76876a9e666f2544e1233366ba">Deny — confirmed threat, the action is blocked&nbsp;</li></ul>The agent never notices unless something is wrong.&nbsp;Sage catches both sides of the risk. It protects agents from external threats like malicious URLs, compromised packages, and dangerous downloads. And it protects users from agents themselves, when they try to run destructive commands, expose credentials, or write to sensitive system files.&nbsp;Here's a concrete example. An agent automating a setup task decides to download and execute a script from the internet. No review, no confirmation. Sage recognizes the pattern and blocks it before anything runs.&nbsp;<h2 class="text-align-justify">Part of a larger commitment</h2>Sage is not a standalone effort. It’s part of a broader strategy to embed continuous trust into the AI skills ecosystem through the Gen Agent Trust Hub.&nbsp;&nbsp;The Skill Scanner of the <a href="https://ai.gendigital.com/agent-trust-hub" target="_blank" rel="noreferrer noopener">Gen Agent Trust Hub</a> helps determine whether an agent extension is trustworthy before it gets installed, using cloud-based verification and classification. Sage picks up where that leaves off. Once the agent is running, it enforces safety locally, on your machine, checking every action at the moment it's about to execute.&nbsp;&nbsp;Together, they cover the full lifecycle: from the decision to install something to the moment it actually runs. More capabilities are on the way as the agentic ecosystem grows.&nbsp;<h2 class="text-align-justify">Open source, on purpose</h2>The agentic platforms themselves are designed for open integration: open-source tools, community plugins, public hook APIs. A closed security layer would be harder to adopt in a space that moves fast and depends on community integrations.&nbsp;At the same time, there is no established playbook for how to secure AI agents. By open-sourcing Sage, we're proposing one and inviting the community to help define what safe agents should look like in practice.&nbsp;This first version is lightweight. It's not a full antivirus product as we know it, but it addresses the problems where they are. It covers the high-risk paths we think matter most: commands, file changes, URL fetches, and package installs, including catching hallucinated or malicious dependencies before they land on your machine. Sage ships with over 200 detection rules covering command injection, persistence, credential exposure, obfuscation, and supply-chain attacks.&nbsp;Sage currently supports Claude Code, Cursor, and OpenClaw, with more platforms on the way. If you find a detection that's too noisy or not strict enough, open an issue. If you want to add a rule, improve a check, or add support for another agent platform, send a pull request.&nbsp;We built Sage to be extended.&nbsp;&nbsp;<h2>Try it</h2>Learn more about Sage at <a href="https://ai.gendigital.com/sage" target="_blank" rel="noreferrer noopener">https://ai.gendigital.com/sage</a>. For technical details, documentation, and source code, visit the project on <a href="https://github.com/avast/sage" target="_blank" rel="noreferrer noopener">https://github.com/avast/sage.</a>&nbsp;If you use Claude Code, Cursor, or OpenClaw, install Sage and put it in the path of real work. The fastest way to improve a safety layer is to expose it to real commands, real repos, and real mistakes. That's what we're doing here — shipping early, in the open.&nbsp;

Closing the growing security gap between what Al agents can do and what keeps them in check

Introducing Sage: Safety for Agents 

AI agents aren’t just helpful in chats anymore. They’re actually taking action on your behalf. Autonomous AI can access data. They move from suggestion to execution without hesitation.&nbsp;This is what we call “mindless artificial intelligence.”&nbsp;When technology starts taking action on our behalf, trust has to be built into the system itself.&nbsp;That’s why Gen is partnering with Vercel to bring independent safety verification to the AI skills ecosystem at <a href="https://skills.sh/" target="_blank">skills.sh</a>, embedding trust directly into the skills layer.&nbsp;

<h2>Independent verification. Built in.&nbsp;</h2>Through this partnership, the Gen <a href="https://ai.gendigital.com/agent-trust-hub" target="_blank">Agent Trust Hub</a> will evaluate skills on skills.sh and assign clear, transparent classifications:&nbsp;🟢 Safe&nbsp; 🟡 Low Risk&nbsp; 🟠 High Risk&nbsp; 🔴 Critical Risk&nbsp;Behind those ratings is advanced risk modeling and threat intelligence from Gen Threat Labs, analyzing permissions, behaviors, vulnerabilities and potential malicious intent.&nbsp;The goal isn’t to slow innovation. It’s to help it scale responsibly. Developers should be able to build boldly. Users should be able to install confidently. And both deserve clarity.&nbsp;<h2>Security as infrastructure, not an afterthought&nbsp;</h2>By integrating verification directly into skills.sh, Gen and Vercel are making security part of the AI development lifecycle, not something bolted on after the fact.&nbsp;In the agentic world, skills are how things get done. Until now, developers and users had limited visibility into whether a skill was truly safe. Reputation and documentation can’t tell the whole story. As agents gain autonomy, guesswork isn’t good enough.&nbsp;The trust has to be visible.

<h2>Powering Digital Freedom in what comes next&nbsp;</h2>At Gen, we believe Digital Freedom means being able to embrace new technology without sacrificing safety or confidence. As AI evolves, our responsibility evolves with it.&nbsp;The future of AI will be powerful. And expansive. But, it must also be secure by design.&nbsp;This partnership is one more step toward building the trust foundation the agentic era demands, so innovation and confidence can grow together.&nbsp;

Bringing transparent risk ratings to the AI skills ecosystem to help developers build boldly and users move confidently

The trust layer for the agentic era 

Dive into data-backed insights from our Threat Labs team. Each report distills real trends uncovered through the Gen family of brands' products, technology and global research, revealing how scams and emerging threats evolve in the real world. We turn billions of signals into stories that help people stay alert, informed, and one step ahead.

Reports

<h2>Foreword</h2>It’s time to take a closer look at the trends shaping the cyber safety landscape.&nbsp;Welcome to the Gen Q4 2025 Threat Report. In Q4, we blocked 1.43 billion attacks, and our global risk ratio rose 17.6% quarter over quarter.

If you spent any time online this quarter, the pattern will feel familiar. You open a browser to look something up. A friend messages you. A bank or payment app asks you to confirm something small. Somewhere in that stream is a link to click, a QR code to scan, a pairing request to approve, or a code to enter. What looks like ordinary digital noise is often the setup for a scam.The center of gravity hasn’t shifted away from people. It has spread across the places they spend their digital lives: browsers, chats and money apps. What changed this quarter is how often that tiny, routine action is the scam. The attack no longer comes later. It happens the moment the door is quietly opened. We also see more campaigns that only work if the victim does the “technical” step themselves. Fake tutorials and download sites persuade users to fetch and run the payload. Device linking tricks people into adding an attacker’s browser as a trusted companion to their messaging app. Verification screens quietly turn into pairing flows that mirror conversations and contacts. Infostealers, spyware and other classics are still there, but some of the most damaging incidents start from what looks like a harmless confirmation dialog.AI sits underneath a lot of this, usually without being named. It is behind fluent, local chats in cloned Steam profiles that sound exactly like a real friend. It can also turn just a few seconds of audio into a believable emergency call from a relative. It lets small groups produce convincing videos that look like investment advice, giveaways or charity requests and drop them into the same feeds people already trust for entertainment and news. At the sharper edge, we have seen state-backed actors using AI systems to handle much of the reconnaissance and scripting work in intrusions, and experimental malware that asks a model how to rewrite itself each time it runs. On the defensive side, AI is just as present in our own security stack, from spotting strange login journeys to flagging scam videos during playback, but there is still a gap between what security technology can see and what people feel they can understand.Privacy and identity continue to act as long-term fuel for abuse. A single&nbsp;<a href="https://blog.avast.com/whatsapp-vulnerability-nearly-leaked-billions-of-phone-numbers" target="_blank">weakness in WhatsApp’s number</a> lookup exposed how easy it was to map billions of phone numbers to active accounts before the issue was fixed. A support vendor for a popular chat platform leaked tens of thousands of government ID photos collected for age checks. Data brokers handed out “samples” that revealed precise daily movements of European officials, easily linked to homes and workplaces. End-to-end encryption is essential, but it can’t protect you once spyware has compromised the device itself. The Landfall campaign showed again that endpoint compromise bypasses privacy promises made at the network layer. &nbsp;Across our own identity alerts and in external research, the pattern is consistent. Breaches, leaks and data sales rarely end with a single notification email. Instead, they resurface months later as account takeovers, fake professionals, synthetic identities and long, difficult recovery cycles.Financial threats are now visible nearly every time people make daily money decisions. They show up when someone opens a new account, tips a creator, pays a bill or reacts to a text that looks like it came from their bank. Stolen identity data is used to pose as the “ideal” new customers applying for loans. Payment features designed for convenience, such as tipping and post settlement adjustments, are used to turn one-dollar transactions into five-figure debits. Microtransactions in games and social apps are increasingly abused for chargeback and refund fraud, where attackers reclaim purchases that were unauthorized after digital goods have already been spent or transferred, shifting the loss onto platforms and merchants. Old-fashioned SMS phishing, upgraded with better language and more convincing lures, still drives some of the largest direct losses when it persuades people to hand over one-time codes that bypass nearly every other safeguard.As we wrapped up 2025, the most striking changes we see are no longer brand new types of malware; it is how tightly attacks are woven into every fiber of our everyday digital routines. Browsers, SMS, chat apps, social media and the tools people use to manage their money now form one continuous surface where trust, identity, privacy and finances intersect. Attackers lean on that continuity, on familiar brands and interfaces, then add automation and AI to reach more people with less effort and less noise.Our job, and the purpose of this report, is to spot those patterns early, measure how they evolve from quarter to quarter and keep shifting protections closer to the small moments where people actually make these choices. Thank you for taking the time to read it, and I hope you enjoy the report.Luis Corrons, Security Evangelist (aka Threat Whisperer)<h2>Threat Landscape Highlights: Q4/2025</h2><h3 class="text-align-justify">Security Threats &amp; Scams</h3>Across Q4, we saw the same core pattern as earlier in the year: most attacks today are not about exotic exploits; they are about getting people to lower their own defenses. What changed last quarter is how many of those scripts now hopped between devices and channels. It started in the browser, continued on the phone, then maybe even landed directly in the calendar instead of the inbox. In parallel, mobile spyware and enterprise extortion continued to evolve under pressure from law enforcement and falling ransom payments, while platforms and business software remained a very profitable surface for scams.<h4 class="text-align-justify">Scam-Yourself Attacks</h4>The Scam-Yourself pattern we highlighted in the past quarters is still very much alive, now with cleaner and more focused campaigns that are easy to see in our data. In November, a single “fake tutorial” domain drove a sharp spike in Scam-Yourself detections. The lure is familiar: users search for tips or cracked software, and land on a page that pretends to walk them through an installation. The twist is that the instructions explicitly ask them to “scan” the screen with their phone camera to continue, pushing the second half of the attack chain onto mobile, where they are more likely to grant extra permissions or install side-loaded apps. A separate campaign in the same period, again dominated by a single domain, used similar tactics to pull people into bogus investment apps on mobile. In both cases, the criminals are not fighting the security model; they are persuading users to carry the payload across device boundaries for them.

<h4 class="text-align-justify">A New Frontier: Calendar Invite Scams</h4>We also saw classic tech support scams arrive through a new front door: <a href="https://us.norton.com/blog/online-scams/norton-calendar-scam" target="_blank">calendar invites</a>. In this scam, instead of a spam email, victims receive an unexpected calendar event that claims a security product subscription has just renewed for hundreds of dollars and includes a phone number “for support.” In our telemetry, tens of thousands of these invites were blocked in a single month. When our testers called one of the numbers, the script followed the same path we have seen for years in phone-based tech support fraud: the agent anchored the fake charge, insisted on remote access to “fix” the issue, and walked the victim through installing a remote access tool such as AnyDesk. The branding was almost incidental. In one call, the calendar mentioned Norton while the scammer talked about “your McAfee subscription.” The details may change; however, the core playbook is stable: steer the conversation to remote control and financial data as quickly as possible.&nbsp; &nbsp;<h4 class="text-align-justify">Mobile Threats</h4>On mobile, <a href="https://us.norton.com/blog/malware/spyware" target="_blank">spyware</a> continued to trend upward in the first half of Q4 and became more invasive. Two Android families, Tambir and SpyMax, dominated our spyware detections in Q4, with a clear peak in November. SpyMax, commonly masquerading as legitimate apps such as Chrome or Netflix, requested network and package-installation permissions, and then used those to silently install additional components with full spying and monitoring capabilities. The impact was global but not uniform, with hotspots in countries such as Morocco, Yemen, Azerbaijan, Portugal and Türkiye. In one of the more sophisticated spyware campaigns of the quarter, researchers uncovered a new commercial-grade Android spyware family called Landfall. This spyware exploited a zero-day vulnerability in Samsung’s image processing library (CVE-2025-21042), which allowed attackers to compromise Galaxy devices via malicious image files, including files sent over apps such as WhatsApp. At this scale, a person’s trust becomes part of the attack surface. While encryption protects data transit, it cannot defend a device that has already been compromised.&nbsp;

The flaw was quickly added to CISA’s Known Exploited Vulnerabilities catalog and patched, but it underlines how messaging and media apps are now both social-engineering channels and mechanisms for exploit delivery.

The economic and legal pressure around spyware increased as well. <a href="https://security.apple.com/blog/apple-security-bounty-evolved/" target="_blank">Apple</a> doubled its top bug bounty award to 2 million dollars for exploit chains that can achieve mercenary-spyware-level access, with bonuses that can push the total award above 5 million. In parallel, a US court granted a permanent injunction <a href="https://www.reuters.com/sustainability/society-equity/us-court-orders-spyware-company-nso-stop-targeting-whatsapp-reduces-damages-2025-10-18/" target="_blank">barring NSO Group</a> from targeting WhatsApp users with spyware, after finding the company liable for hacking hundreds of accounts, although it significantly reduced an earlier damages award. Combined with the <a href="https://techcrunch.com/2025/11/07/landfall-spyware-abused-zero-day-to-hack-samsung-galaxy-phones/" target="_blank">Landfall case</a> and our own spyware telemetry, the picture is clear: phones are now the primary surveillance target for both everyday stalkerware-like campaigns and highly resourced actors, and the market value of mobile zero-days has risen accordingly.<h4 class="text-align-justify">Ransomware</h4><a href="https://www.avast.com/c-what-is-ransomware" target="_blank">Ransomware</a> and extortion remained active but showed signs of stress. On the consumer side, ransomware encounters in our telemetry declined 6.8% year over year in 2025,&nbsp;staying well below the elevated levels we saw during the Magniber-driven highs that began in 2024 and persisted until this summer, when the campaign was stopped. We still observed smaller, more targeted incidents, including new Trinity-family ransomware samples going after small and mid-sized businesses, but not a broad return of mass-spread ransomware lockers.&nbsp;Externally, incident response data points in the same direction. Coveware <a href="https://www.securityweek.com/ransomware-payments-dropped-in-q3-2025-analysis/" target="_blank">reported</a> that only about 23 percent of ransomware victims paid in Q3 2025, a historical low, with average and median payments dropping by roughly two-thirds compared to the previous quarter as big enterprises increasingly refuse to pay and mid-market firms negotiate smaller amounts. Chainalysis, looking at blockchain flows, estimated that <a href="https://www.theguardian.com/technology/2025/feb/05/global-ransomware-payments-plunge-by-a-third-amid-crackdown" target="_blank">global ransomware payments in 2024 fell</a> from 1.25 billion dollars to around 813 million, roughly a one-third drop year on year, a proof point that consumers and businesses alike are becoming more educated on how to manage ransomware extortion. Taken together, this suggests that the traditional encrypt-and-extort model is under real pressure, even though the number of groups and leak sites remains high.&nbsp;<h4 class="text-align-justify">Infostealers, Vulnerabilities and Other Exploits</h4>Law enforcement pressure also spilled over into commodity crimeware infrastructure. In November, Operation Endgame, a coordinated international action, disrupted infrastructure used by infostealers such as Rhadamanthys, VenomRAT and Elysium, taking large numbers of servers and several domains offline. In our telemetry, Rhadamanthys detections dropped sharply after mid-November and remained low throughout the rest of the quarter. This marks a rare instance where a public takedown aligns with a clear and sustained decline in activity from a specific threat family.&nbsp;The broader infostealer ecosystem, however, did not disappear. And other stealer families continued to operate. Something to think about here: do high-profile disruptions like this meaningfully change attacker behavior over the long term, or do they simply create space for the next malware-as-a-service brand to emerge?

One structural shift that happened in the background during Q4 is the nearing of the end of <a href="https://support.norton.com/sp/jp/in/home/current/solutions/v20250829220006792">support for Windows 10</a>, which will leave millions of still-active PCs on an increasingly unpatched operating system. That long tail of unsupported devices keeps older exploit chains profitable and turns legacy Windows into a standing pool of soft targets, from ransomware affiliates and botnet herders to infostealer operators.In the world of extortion, this quarter, the Cl0p group and other actors ran large-scale extortion campaigns against organizations using Oracle E-Business Suite, exploiting a critical unauthenticated remote code execution flaw, <a href="https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation">CVE-2025-61882</a>, to break into internet-facing instances and exfiltrate data. Victims ranged from universities and airlines to health providers and media outlets, many of whom only discovered the breach when they received extortion emails or saw their data listed on leak sites. Separately, the Scattered Lapsus$ Hunters collective claimed to have stolen more than a billion customer records from companies that rely on Salesforce, and published samples tied to firms in sectors such as insurance, airlines and credit reporting. In both cases, the pattern is similar: rather than encrypting endpoints, attackers look for central business platforms, exploit a single point of failure and then treat stolen data as the primary ransom lever.<h4 class="text-align-justify">Scams</h4>Last but certainly not least, scams continued to scale by riding on top of mainstream platforms and trusted infrastructure. Scams, overall, continue to be a leading problem for consumer cyber safety. In 2025, there were 41 scams blocked every second, on average.In our Q4 analysis of scams originating on social platforms, one theme stands out: concentration. Facebook alone accounts for 78.04% of social-origin scam blocks on desktop. When combined with YouTube, that figure rises to 95.71%. In plain terms, the vast majority of risky scam clicks begin in just two places: the social feed and the video loop.The second defining pattern is what those clicks are designed to do. In Q4, e-shop scams dominate at 65.4% of social-origin blocks. Phishing followed at 15.09%, then generic scams (7.58%), tech support scams (6.28%), dating scams (3.45%) and financial scams (2.12%).&nbsp;Each scam type also has its own “platform fingerprint.” For example, tech support scams are almost entirely Facebook-driven (99.25%), while phishing spreads more widely across Facebook (77.34%), YouTube (13.66%) and Reddit (3.94%).Where the scam click starts (platforms)<ol><li data-list-item-id="eb40370c21eef3b7317f242e605fadf5c">Facebook, 78.04%</li><li data-list-item-id="edce3c32d95987f7ab5c473e3392b7acb">YouTube, 17.67%</li><li data-list-item-id="ebb0b9f86762211dc36c60026bd66053c">Instagram, 2.16%</li><li data-list-item-id="e528f6738c8aeb1a0fe8d7858cb7b1758">Reddit, 0.65%</li><li data-list-item-id="e5513daffc673bcda2ed6e14baea51272">X, 0.60%</li><li data-list-item-id="e71c768777d2fb909c2ec0633b4d75b6d">TikTok, 0.38%</li></ol>What the scam is trying to do (types)<ol><li data-list-item-id="e9a62c7b410b345bc939103042b237a07">E-shop scams, 65.40%</li><li data-list-item-id="e8c12513e9af7b1db743ce2ccb5e48ec1">Phishing, 15.09%</li><li data-list-item-id="e6d341fbb668c55de4950b76bbf8e93eb">Generic scams, 7.58%</li><li data-list-item-id="ee2d1344f48aa9608afd2bcf9e58d6a7d">Tech support scams, 6.28%</li><li data-list-item-id="ea041a1217cef799ca06468f7fe9b5671">Dating scams, 3.46%</li><li data-list-item-id="e27b966549b1aaaf3fe1199c86e46ffe4">Financial scams, 2.12%</li></ol>Our telemetry also showed a marked increase in e-shop scams in Q4 on both desktop and mobile. In fact, roughly half of all e-shop scam blocks we recorded in 2025 occurred in Q4, reflecting a surge in blocked fraudulent shops. The data is unsurprising considering the holiday period and public reports showing that Meta made around <a href="https://www.reuters.com/investigations/meta-is-earning-fortune-deluge-fraudulent-ads-documents-show-2025-11-06/" target="_blank">10 percent of its annual revenue in 2024</a>, roughly 16 billion dollars, from fraudulent ads and banned product listings, based on internal documents discussed in recent investigations. Those reports describe billions of scam-related ads per day, with some internal systems rating ads as highly likely to be fraudulent yet allowing them to run. For ordinary users, the distinction between an “ad platform” and a “scam delivery system” is increasingly academic. On the supply-chain side, the <a href="https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spreads-from-npm.html" target="_blank">discovery</a> of the ShaiHulud v2 malware in npm packages reinforced how popular developer ecosystems can be abused to push info-stealers and backdoors into thousands of build environments with minimal friction.

In short, Q4’s security threats and scams were less about brand-new malware families and more about the reuse of proven scripts and approaches across new channels: fake tutorials that jump from screen to phone, tech support scams that land in calendars instead of inboxes, spyware that hides inside image files and extortion crews that skip encryption and go straight for the data. Law-enforcement takedowns and falling ransom payments are clearly having an impact; the broader crime stack, from Scam-Yourself flows to platform-scale scams and enterprise app exploits, remains very active and continues to evolve.<h3 class="text-align-justify">AI-Driven Attacks &amp; Defenses</h3>Across nearly all threat types we monitored this quarter, AI stopped being a side topic and became part of the default background for both attackers and defenders. We saw three clear shifts: 1. Threat actors are starting to treat LLM exploits and “agentic” workflows as ordinary tools, 2. Social-engineering scams are being upgraded with AI voices, faces and scripts, and 3. On the defensive side, both platform providers and security products are racing to build AI-native protections.On the offensive side, LLM abuse is moving from experiments into the real economy. Recent investigations into LLM <a href="https://www.darknet.org.uk/2025/10/llm-black-markets-in-2025-prompt-injection-jailbreak-sales-model-leaks/" target="_blank">black markets</a> describe sellers offering jailbreak prompt packs, prompt injection recipes, and access to leaked models or stolen API keys, packaged much like exploit kits or malware builders. Rather than inventing their own jailbreaks, criminals can now buy prompts that work against the most popular models and plug them into phishing frameworks, fraud bots or custom tools.

The most visible AI abuse leap in Q4 came from the nation-state space. <a href="https://www.anthropic.com/news/disrupting-AI-espionage" target="_blank">Anthropic</a> disclosed that a China-linked group jailbroke its Claude Code model and used it to orchestrate a multi-step espionage campaign against roughly thirty organizations, including financial and government-related targets. According to Anthropic, the AI handled approximately eighty to ninety percent of the workflow, from reconnaissance and code generation to log parsing and data staging, with humans mostly approving steps and correcting mistakes. This is no longer “AI helped me write some malware”; it is AI acting as a junior operator across an entire campaign.<a href="https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools" target="_blank">Google</a>’s Threat Intelligence Group reported something similar at the tooling level. Its AI Threat Tracker documents experimental malware such as PROMPTFLUX and PROMPTSTEAL, droppers that call an LLM at runtime to rewrite their own Visual Basic Script, change obfuscation and adjust evasion on the fly. Instead of shipping a static payload, attackers ship a template that asks an AI model how to change itself every time it runs. This matches the “just in time” self-modification pattern we highlighted in earlier quarters, but now in code that actually runs on victim machines.Operating systems are also becoming more “agentic,” which opens a new front. Microsoft’s new agent workspace features for Windows 11 are designed to let AI assistants perform tasks for the user with their own desktop, local account and access to folders such as Documents, Downloads and Desktop, when enabled. In its own security guidance, Microsoft warns that these agents introduce novel risks such as cross-prompt injection, where malicious content embedded in a document or user interface can override agent instructions and trigger data exfiltration or software installation. For now, these features are disabled by default and limited to preview builds, but the direction is clear. If you let an AI agent act inside the OS, anything that can steer it becomes part of the attack surface.

Where AI touches people directly, the main shift is in social engineering, which already accounted for over 90% of all blocked attacks in 2025. Voice cloning has already changed “grandparent scams” and family emergency fraud. Police in Canada, among others, have warned about an uptick in cases where criminals use a <a href="https://www.pcmag.com/news/microsofts-ai-program-can-clone-your-voice-from-a-3-second-audio-clip" target="_blank">few seconds of audio</a> from social media or voicemail to generate a convincing copy of a relative’s voice, pair it with a scripted accident or kidnapping story, and pressure victims into urgent transfers. In our featured story Love at machine speed, we zoom in on this broader pattern. AI makes romance scams and sextortion campaigns feel like full-on relationships, with coherent photos, voice notes, short videos and even documents that all feel fully authentic. The scam does not have to be linguistically brilliant; it just has to feel consistent and emotionally tuned, then pivot into money asks, “verification” flows or intimate exchanges that can be turned into extortion.We also see smaller, more personal versions of these emotional, relational scams happening on gaming platforms. On Steam, for example, we have observed waves of friend requests from cloned or lookalike accounts that mirror real contacts, followed by smooth, localized chat messages that clearly have an LLM “feel” to them. The goal is not to impress anyone with language skills. It is to lower suspicion in your native language, then steer the conversation toward off-platform links, giveaways or trading “opportunities”.Our featured story How AI made video scams personal, one viewer at a time looks at the same trend from the video side. In 2025, YouTube and other platforms became fixtures of living-room TV time, not just phone habits, and video recommendation engines now shape a large share of what people watch. That shift is exactly why we built <a href="https://support.norton.com/sp/en/us/home/current/solutions/v2025051222180272">Deepfake Protection</a> around the intersection of manipulated media and scam intent, using multi-modal signals from the clip itself (including indicators of cloned or heavily edited audio) plus contextual cues like money requests, urgency scripts, and off-platform handoffs. Early telemetry shows that most blocked AI scam videos cluster on a handful of major platforms, with YouTube leading by share of blocks and Facebook and X behind it. The majority are not spectacular, viral deepfakes. They are ordinary-looking clips, often with cloned or heavily edited audio, tied to financial and cryptocurrency lures. That is why the story argues that AI in a clip is not a risk signal by itself; the meaningful signal is AI paired with a request for money, an off-platform handoff or a time pressure script.AI also shows up around account takeovers. In The code that steals your WhatsApp, we follow a device-linking abuse pattern – what we call GhostPairing – where a simple “I found your photo” message lures victims to a fake login page that uses WhatsApp’s own pairing flow to add the attacker’s browser as a ghost device on the account. The core trick is pure social engineering around a legitimate feature; however, the consequences line up with our AI concerns. Once a WhatsApp account is silently mirrored, attackers can read private chats, learn which contacts are most trusted, and harvest voice notes and photos that can later be fed into voice cloning and synthetic media tools. The attack itself is not “AI-malware," but it builds the raw material that AI-powered fraud will later exploit.Outside of personal relationships and messaging, AI is also being used to impersonate professionals and institutions. Reporting from the <a href="https://www.thebureauinvestigates.com/stories/2025-11-26/scammers-use-ai-to-impersonate-real-lawyers-on-fiverr">Bureau of Investigative Journalism</a> found dozens of Fiverr listings where scammers posed as real UK solicitors (attorneys), stealing names and registration numbers from the Solicitors Regulation Authority and pairing them with AI-generated headshots and boilerplate text. These profiles advertised legal services and, in some cases, boasted about using AI to draft contracts. The same playbook maps easily onto other roles, such as investment advisors or “remote employees.” We deliberately handle those themes more fully in the Trust and Identity section, but they belong in the AI picture as well.Meanwhile, defenders are adapting, although not always as quickly as attackers. On the platform side, Anthropic, Google and Microsoft all treat AI misuse as a security problem, not just a policy issue. Anthropic’s disruption of the Claude-driven <a href="https://www.anthropic.com/news/disrupting-AI-espionage" target="_blank">espionage campaign</a> fed directly into new monitoring and safeguards against similar abuse. Google’s AI Threat Tracker is building a <a href="https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools" target="_blank">public catalogue</a> of how state-backed and financially motivated actors use AI across reconnaissance, exploitation and post-compromise stages. Microsoft’s agentic security guidance, while still evolving, at least names cross-prompt injection and agent containment as core design problems for the Windows ecosystem.&nbsp;In our own security stack, AI runs on both sides of the line. The same technology that helps criminals localize scripts and industrialize lures also helps our protections spot subtle combinations of signals that only make sense in context, not as single keyword rules. That includes login and device linking flows that deviate from legitimate patterns, payment journeys that show telltale friction points and coercion cues, and video or audio that pairs polished, synthetic-sounding narration with high-pressure financial pitches and off-platform handoffs. In Q4, on devices where our video scam detection feature was enabled, we detected 159,378 unique deepfake scam video instances that matched this intersection of manipulated media and scam intent.&nbsp;The three featured stories in this report are case studies of how this plays out in the real world: deepfake-style media stitched into financial scams, AI-orchestrated romance and sextortion scripts, and messaging account takeovers that quietly gather the raw material for future AI misuse.The common thread in most research on AI is that it has become part of the normal toolkit, not a special effect. Some campaigns, such as the Anthropic case and PROMPTFLUX, use AI inside the malware and command chain. Others, such as AI video scams, romance fraud and GhostPairing, use AI to shape what victims see and hear. On the defensive side, both cloud providers and endpoint protection are starting to respond in kind. For people and organizations, the practical rule is straightforward. Any tool that can act on your behalf or strongly shape what you see and hear now deserves the same caution as a high privilege application: less access, explicit approval for sensitive actions, and a healthy suspicion of any AI-shaped request that tries to move money, data or trust onto someone else’s schedule.<h3 class="text-align-justify">Privacy</h3>This quarter also demonstrated how fragile privacy still is when convenience, third-party vendors and opaque data markets collide. Even as lawmakers tighten some rules and platforms announce new “privacy-preserving” architectures, our own telemetry and outside incidents point to the same pattern: data collected for one purpose keeps landing in the wrong hands, and the basic identifiers that anchor digital life, especially phone numbers and device IDs, remain sought after.<h4 class="text-align-justify">Data keeps leaking through the side doors</h4>

Two incidents captured the structural risk of outsourcing sensitive data handling, from identity verification to location tracking, to third parties. Discord <a href="https://www.theguardian.com/media/2025/oct/09/hack-age-verification-firm-discord-users-id-photos" target="_blank">disclosed</a> that a breach at a customer-support vendor exposed around 70,000 government ID photos used for age verification, meaning a single helpdesk relationship turned into a trove of passport-level data.&nbsp;In Europe, <a href="https://netzpolitik.org/2025/databroker-files-targeting-the-eu/" target="_blank">investigative reporters</a> demonstrated how easy it is to buy precise mobile location trails from data brokers. A “free sample” dataset contained hundreds of millions of location points that could be tied back to individual EU officials simply by matching daily patterns to home and work addresses. Both cases illustrate the same trend: once data is collected for “support” or “advertising,” it can be repackaged, resold, and analyzed in ways users never anticipated.

The biggest privacy shock of the quarter came from WhatsApp’s contact discovery system. Researchers from the University of Vienna and SBA Research showed that by abusing an under-protected API, they could enumerate roughly <a href="https://www.wired.com/story/a-simple-whatsapp-security-flaw-exposed-billions-phone-numbers/" target="_blank">3.5 billion WhatsApp accounts</a>, confirming whether a given phone number is registered and, for many users, retrieving profile photos and “about” text. Meta has now tightened rate limiting, and our own blog, <a href="https://www.gendigital.com/blog/insights/leadership-perspectives/whatsapp-phone-number-privacy" target="_blank">The WhatsApp privacy scare you probably missed</a>, walks through why “no evidence of abuse” is not the same as “no risk” and how a single phone number can be the thread that links old and new data leaks together.&nbsp;Commercial spyware campaigns offered another stark reminder that once a device is compromised, theoretical privacy guarantees collapse. The Landfall spyware <a href="https://arstechnica.com/gadgets/2025/11/commercial-spyware-landfall-ran-rampant-on-samsung-phones-for-almost-a-year/" target="_blank">abused</a> a zero-day in Samsung’s image processing to infect Galaxy phones via malicious pictures sent in WhatsApp, then silently accessed photos, messages, contacts, call logs, the microphone and precise location for months. At that level of compromise, encryption and consent banners offer little more than the appearance of protection.<h4 class="text-align-justify">Our telemetry: trackers stabilize while breaches continue to climb</h4>On the tracking side, our Norton AntiTrack Windows telemetry shows that classic browser tracking and fingerprinting remain pervasive, but there are early signs of stabilization. The number of trackers and fingerprinting attempts detected per device on Windows flattened and even decreased in Q4 compared with earlier quarters, although overall volumes remain high. In practical terms, this means that the underlying tracking ecosystem has not gone away, even as some platforms talk about moving “beyond cookies.” Tools that actively block trackers and fingerprinting continue to do real work in the background.

<h4 class="text-align-justify">Global privacy rules are drifting in different directions</h4>Regulators did not stand still this quarter, but the net effect is patchwork rather than a clear global standard.In the EU, the Commission’s proposed “<a href="https://www.reuters.com/sustainability/boards-policy-regulation/critics-call-proposed-changes-landmark-eu-privacy-law-death-by-thousand-cuts-2025-11-10/" target="_blank">Digital Omnibus</a>” package would delay key “high-risk” AI rules until late 2027 and relax how companies can use sensitive data, including health and biometric information, for AI training under “legitimate interest.” Heated discussions are expected ahead as data access will need to be balanced with privacy needs.India moved in the opposite direction by activating its <a href="https://www.facebook.com/pibindia/posts/digital-personal-data-protection-dpdp-rules-2025-notifieda-citizen-centric-frame/1396013389233122/" target="_blank">Digital Personal Data Protection Rules 2025</a>, which formalize a consent-centric regime with tighter rules on purpose limitation and breach notification for everyday apps and digital services. In the United States, the proposed <a href="https://www.globalpolicywatch.com/2025/11/u-s-senate-introduces-the-health-information-privacy-reform-act/" target="_blank">Health Information Privacy Reform Act</a> (HIPRA) would extend HIPAA-style protections to health and fitness apps that have historically lived in a legal grey zone, reflecting concern over the volume of sensitive health telemetry collected by wearables and wellness platforms.&nbsp;At the state level, California continued to blaze new frontiers. The new “<a href="https://www.cdflaborlaw.com/blog/web-browsers-must-allow-users-to-opt-out" target="_blank">Opt Me Out Act</a>” (AB 566) will require browsers to offer a built-in global opt-out signal by 2027, and websites subject to the California Consumer Privacy Act (CCPA) will have to honor that signal as a valid “do not sell or share” request. The <a href="https://cppa.ca.gov/meetings/materials/20251107.html" target="_blank">California Privacy Protection Agency</a> is also progressing separate work on deletion and opt-out platforms and child-focused privacy safeguards. Together, these moves suggest that browser-level privacy controls and automated opt-out signals are becoming a default expectation in key US states.<h4 class="text-align-justify">Big tech recalibrates privacy promises, but tracking lives on</h4>Platform responses to these pressures have been mixed. Google effectively <a href="https://www.thurrott.com/cloud/328530/its-official-googles-privacy-sandbox-is-dead" target="_blank">shut down</a> most of its Privacy Sandbox initiative, acknowledging that the proposed replacements for third-party cookies saw limited adoption and heavy scrutiny. In practice, this means that conventional tracking cookies and related techniques will stick around longer than many anticipated, which matches what we continue to see in our AntiTrack telemetry.

At the same time, Google introduced its <a href="https://blog.google/technology/ai/google-private-ai-compute/">Private AI Compute</a> architecture, a cloud environment that promises to run powerful Gemini models on user data inside hardware-isolated, encrypted enclaves that even Google cannot directly inspect. Apple, for its part, <a href="https://techcrunch.com/2025/11/13/apples-new-app-review-guidelines-clamp-down-on-apps-sharing-personal-data-with-third-party-ai/">updated App Store Review Guidelines</a> so that apps must explicitly tell users and obtain permission before sending personal data to third-party AI services.&nbsp;These are meaningful steps, but they do not remove the core risk that sensitive data is leaving the device. They shift the conversation from “whether” to share data with cloud AI to “under what rules and guarantees”. As long as traditional web tracking also persists, we expect anti-tracking and anti-fingerprinting controls to remain critical scaffolding for any realistic privacy posture.<h4 class="text-align-justify">What this adds up to</h4>Across all of these signals, the privacy story this quarter is less about a single spectacular leak and more about accumulation. Third-party vendors and data brokers expand the surface where sensitive information can escape. Messaging flaws and commercial spyware show how metadata and on-device compromise can undo the comfort of end-to-end encryption. Regulators are pushing in different directions, with some jurisdictions tightening controls while others are making AI training easier. Platforms are quietly backing away from ambitious tracking replacements while introducing new AI-centric data flows.&nbsp;For our customers, that combination means privacy is no longer a static setting. It is a moving target that depends on how many third parties touch their data, how their devices are secured, and whether they run tools that can strip out trackers, flag breaches early and warn when their identifiers, from phone numbers to government IDs, are being reused in risky ways. Increasingly, that also includes services like <a href="https://us.norton.com/products/privacy-monitor-assistant">Privacy Monitor Assistant</a>, which automatically scans data broker sites for their personal information and requests its removal when it resurfaces.<h3 class="text-align-justify">Trust &amp; Identity&nbsp;</h3>Trust used to be about whether a website had a padlock or a caller knew your name. In Q4, it is increasingly about whether the person, service or document on the other side is even real. Identity is no longer just a target; it is the main attack surface. Our data and external research both show the same pattern: more identity-based fraud, more synthetic and stolen personas, and a fast-growing ecosystem of tools that claim to protect people from exactly that.<h4 class="text-align-justify">Identity fraud moves from edge case to default risk</h4>Across industries, businesses report that fraud is increasingly identity-led rather than purely transactional. AuthenticID’s latest analysis of enterprise customers shows a 42 percent year-over-year <a href="https://www.sdxcentral.com/news/authenticid-report-reveals-surge-in-identity-based-fraud-across-businesses/">surge in fake IDs and suspicious biometric matches</a>, with overall fraud rates hitting 2.10 percent, the highest level in three years. In the same survey, nearly 70 percent of organizations said they were concerned about generative AI making <a href="https://lifelock.norton.com/how-it-works/what-is-identity-theft" target="_blank">identity fraud</a> harder to spot, and more than two-thirds had already experienced workforce-related fraud in the last year, often involving compromised or fabricated identities rather than simple account misuse.&nbsp;The <a href="https://www.experian.com/thought-leadership/business/identity-and-fraud-report">2025 Global Identity and Fraud</a> report tells a similar story. Around 90 percent of businesses say they are worried about fraud, and almost 60 percent report higher fraud losses year on year, with identity theft, account takeover and payment fraud at the top of the list. Many have already increased their fraud prevention budgets and expect AI-generated deepfakes and synthetic identities to be major challenges by 2026. Consumers, however, are not reassured. A majority still feel uneasy about having more of their lives online, and there is a noticeable gap between the confidence businesses have in their own controls and the level of trust people actually report.&nbsp;In short, identity is where attackers invest and where defenses are playing catch-up. That is exactly what we see in our own telemetry.<h4 class="text-align-justify">What our identity alerts say about real people</h4>Our LifeLock data looks at consumer-focused identity events over time: new records, suspicious transactions, dark web exposure and scam-driven alerts, all converted into risk ratios so we can see what share of our customers are actually at risk during a given period.In Q4 2025, several types of alerts climbed noticeably, the figures below show the quarter-over-quarter change in average monthly alerted users:<ul><li data-list-item-id="e382f3a066147c01399197f6ac26a4706">Property-related record alerts (unauthorized filings): +252.27%</li><li data-list-item-id="e3351da7a455692c66228a4f18611b703">Breach alerts&nbsp;(possibly data exposure, even when the source isn’t yet known): +221.72%</li><li data-list-item-id="e61ae9b31e95e64f09b524430348eaedc">Bank account activity alerts (suspicious activity beyond credit lines): +112.34%&nbsp;</li></ul>We also introduced and started tracking a set of new alerts that monitor identity abuse deeper in the financial system. These include:<ul><li data-list-item-id="ec68775737df65ae46281d8b9ac773316">Alerts on suspicious activity within credit-based accounts, such as credit cards or lines of credit.</li><li data-list-item-id="ea9e82c04405a8560b47600da78413906">Alerts on new applications for installment loans, leases and retail cards opened in a customer’s name.</li><li data-list-item-id="e7cecafcf128d099b1034c3c661c5f11e">Transaction-level alerts on credit cards and installment loans that flag unusual or high-risk payments.&nbsp;</li></ul>These alerts do not just add volume. They move protection closer to the first moment where a stolen or synthetic identity turns into a concrete financial obligation: a new loan, a new lease, a new credit line, or a suspicious transaction. The rising risk ratios in these categories reinforce what external reports suggest: identity fraud is getting more layered, touching property records, deposits, credit instruments and scam-driven social engineering in parallel.

Data breach events accelerated sharply in Q4, both in frequency and scale (based on our product users). Monthly breach events rose from a low of 307 in January to a peak of 3k+ in November, before closing the year at 2,243 incidents in December, representing a +175.23% quarter-over-quarter increase in total breach events.&nbsp;The volume of exposed data followed a similar trajectory: breached records climbed from 557k in July to more than 2.09 million records in December, driven by a sharp spike in November (1.4 million records). Overall, the amount of breached data increased +157.36% QoQ, underscoring not just more frequent breaches, but larger and more consequential exposure events as the quarter progressed.To interpret the identity alert ratio correctly, it helps to separate volume from severity. The identity alert ratio shows the share of active users who received at least one alert of a given type in the period, including early warning signals as well as higher-impact events. Some alerts are low-friction indicators; others point to concrete exposure, such as an unrequested loan application, suspicious account activity, or confirmed data exposure. Taken together, the trend suggests identity-related issues are affecting a growing portion of our user base, not just a small unlucky subset.

<h4 class="text-align-justify">Personal identifiers are becoming skeleton keys</h4>The WhatsApp incident covered in our blog, “<a href="https://www.gendigital.com/blog/insights/leadership-perspectives/whatsapp-phone-number-privacy" target="_blank">The WhatsApp privacy scare you probably missed</a>”, was a clear reminder that a single identifier can unlock a lot more than people realize. The underlying lesson – and risk – is not limited to WhatsApp. Phone numbers and similar identifiers are increasingly treated as universal keys across messaging apps, banking, recovery flows and two-factor prompts. When they leak, attackers can combine them with old breach data, open profile information and cheap lookup tools to reconstruct profiles of who you are, where you live, who you talk to and which services you most likely use. These profiles make it much easier to craft believable <a href="https://www.avast.com/c-phishing" target="_blank">phishing</a>, SIM-swap attempts, fake support calls or password reset tricks that look “just personalized enough."We see the same pattern in our LifeLock alerts when scam or phishing events spike at the same time as breach notifications and new financial applications. Your identity is usually not compromised in a single dramatic event. It is probed, enriched and reused over time, with each exposed data point making the next attack more convincing.Two of this quarter’s featured stories highlight this trajectory at a personal level. The GhostPairing WhatsApp takeover piece shows how a single pairing code can silently add a “ghost” device to your account, turning your own chat history, voice notes, and contacts into tools for further impersonation. The AI-assisted romance scams story shows how photos, voice and social profiles can be stitched into complete synthetic partners that feel real to victims while they are being nudged toward verification pages, investment portals or intimate exchanges. Both cases build on the same idea: your identifiers and traces become the raw material for someone else’s script.<h4 class="text-align-justify">Synthetic professionals and ghost employees</h4>It is not only individuals who are dealing with identity risk. Organizations are also being fooled by fake colleagues and professionals who exist only on paper and in pixels.In the United States, several defendants <a href="https://www.techradar.com/pro/security/north-korean-fake-worker-scheme-caught-live-on-camera" target="_blank">pleaded guilty</a> in a case that revealed how North Korean IT workers, operating under false names and using stolen or borrowed US identities, managed to secure remote jobs at hundreds of companies. They funneled salaries and back to North Korea, bypassing sanctions and giving access to corporate networks and codebases were being handled by people very different from the resumes on file.On the services side, investigations into the freelance marketplace Fiverr exposed dozens of profiles that <a href="https://www.solicitorsjournal.com/sjarticle/scammers-exploit-fiverr-posing-as-solicitors?category=News" target="_blank">impersonated real UK solicitors</a> using stolen Solicitors Regulation Authority credentials paired with AI-generated headshots. Some of these fake “lawyers” openly admitted to using AI tools to generate legal documents for clients, while regulators reported more than 1,400 scams involving impersonation during the year.&nbsp;The common thread in these cases is not just that criminals are lying about who they are. It is that they are hijacking institutional trust signals: bar numbers, professional registries, corporate HR processes, video calls and polished headshots. When these markers are cheap to fake and hard to verify at scale, both individuals and organizations end up making high-stakes decisions based on identities that never really existed.Again, our internal telemetry aligns with this. The uptick in new applications for credit products and leases under LifeLock monitoring is consistent with synthetic identities being used to open lines of credit or rent assets that will never be paid for.<h4 class="text-align-justify">Defenses are catching up, but trust is fragile</h4>The defensive side of this picture is evolving quickly. Global investment in digital identity protection, fraud detection and financial crime technology continues to grow. <a href="https://www.researchandmarkets.com/reports/5792959/identity-theft-protection-services-market-report?srsltid=AfmBOorwPIgcrhHEzd4_Lkl69j4E2egwKuTMc51EQBIWB7g0Lc2mdh48" target="_blank">Analyst reports</a> on the identity theft protection market, for example, expect the global sector to rise from roughly 14.5 billion dollars in 2025 to more than 23 billion by 2029, with double-digit annual growth as more consumers pay for dedicated monitoring and restoration services.&nbsp;In regulated industries like banking and insurance, digital identity protection is now treated as core infrastructure rather than a nice-to-have. <a href="https://www.everestgrp.com/press-releases/everest-group-releases-three-latest-reports-focusing-on-digital-identity-generative-ai-and-leading-technology-providers-in-financial-crime-and-compliance.html" target="_blank">Everest Group</a>’s recent work on digital identity and financial crime notes that financial institutions are moving toward layered systems that combine identity verification, strong authentication and compliance automation, increasingly with AI and biometrics in the loop.&nbsp;The challenge is that technology alone does not fix the trust gap. An <a href="https://www.experian.com/thought-leadership/business/identity-and-fraud-report" target="_blank">Experian</a> survey shows that more than 80 percent of people expect companies to take active steps to protect their identity and privacy, yet far fewer actually trust that those companies are doing enough. Many people want both stronger protection and less friction, which is a hard combination to deliver. When identity checks are too intrusive or wrongly block legitimate users, people quickly lose patience. When checks are invisible and permissive, fraud finds the gaps.&nbsp;Our own experience echoes that tension. Adding new alert types makes it easier to spot the early stages of identity abuse, but it also increases how often we ask people to verify themselves. If every warning feels urgent, users tune out. If one critical alert looks like every marketing email, it gets ignored – our products work hard to balance these tensions to ensure people are alerted appropriately.<h4 class="text-align-justify">Where this leaves people</h4>The trend in Trust &amp; Identity this quarter is clear: more of the risk people face is expressed as identity events rather than isolated <a href="https://us.norton.com/blog/emerging-threats/malware" target="_blank">malware infections</a>. Stolen or fabricated identities show up as new property records, breach notifications, suspicious deposits, new credit lines and scam-driven alerts in customers’ accounts. Businesses are ramping up their use of digital identity tools and AI-assisted fraud detection, yet still struggle to keep pace with criminals who can cheaply clone faces, voices, documents and resumes.For individuals, the practical implications are simple but uncomfortable:<ul><li data-list-item-id="e9bfa5e1ad7f8ff266e03dc2617c2af3a">Your phone number, email, government IDs and professional credentials are treated as universal keys across many systems. When one of them leaks, it is not a minor nuisance; it is a long-term risk factor.</li><li data-list-item-id="e691e20569c743a5ceb7641b86dc940c3">“Verified” is not binary anymore. A bar number, a corporate email or a polished profile can be perfectly fake, especially when AI does the heavy lifting.</li><li data-list-item-id="e76da762ee8d5d0bd9ea977451f45bb80">Digital identity protection is becoming something you must maintain continuously, not a one-time fix after a breach notice.</li></ul>In the remainder of this report, we will show how these abstract trends play out in concrete stories, from account takeovers that add ghost devices to your chats, to AI-orchestrated romance scripts that wrap themselves around your emotions, finances and documents. Taken together, these stories show that the real battleground is not a login page; it is the evolving relationship between who you think you are online and who your data claims you are.<h3 class="text-align-justify">Financial Wellness&nbsp;</h3><a href="https://lifelock.norton.com/learn/fraud/bank-scams" target="_blank">Financial scams</a> follow money habits. They show up wherever people check bank balances, apply for loans, move money between accounts, or try to stretch a paycheck. Until now, our view of that space came mostly from classic cyber telemetry, for example, banking phishing, fake investment portals and payment fraud.In 2025, Gen added MoneyLion to its portfolio, empowering consumers to confidently manage and protect their digital and financial lives. <a href="https://www.moneylion.com/" target="_blank">MoneyLion</a> democratizes&nbsp;access to financial tools like credit-building, savings, and personalized advice through a single mobile app. &nbsp;With MoneyLion now part of Gen, we have a new vantage point on how financial risk appears in real life, at the exact moment when people are choosing products and making decisions about their money.Across Q4, four patterns stand out. They do not look like traditional “banking Trojans,” but together they show how fraud is threading itself into everyday financial behavior.<ol><li class="ck-list-marker-bold" data-list-item-id="e7e5b91c69e23ca392e68ce54808e1b95">Stolen identities are pushed into onboarding, not just into logins</li></ol>In November 2025, MoneyLion’s data science team flagged a burst of new account applications that looked legitimate on the surface but failed deeper checks. Follow-up analysis showed three constants:<ul><li data-list-item-id="ed2fecb160927f3c7b558568969d700ed">The identity data looked real, not invented, and was good enough to pass basic<a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank"> Know Your Customer (KYC) processes</a>.</li><li data-list-item-id="e8bc0cf7d814b2d781fd826d1ec1eb81f">Deeper checks on devices, IP addresses and declared locations did not line up, with discrepancies between IP and claimed home address or very recent sightings of those devices.</li><li data-list-item-id="eeef860c353f9f3ef512d8650db1e956d">A clear clustering around the same external bank as the linked account.</li></ul>In other words, this was not a random spray of fake applications. It was a low-volume, high-quality push using stolen identity kits and existing bank accounts to try to pass as “perfect new customers” for a banking-style product. MoneyLion’s layered controls, including step-up identity verification backed by risk scoring, stopped all of these attempts, so there were no recorded losses from this wave.What we learned from this pattern is important. It repeats behavior seen earlier against other US institutions, such as Citizens Bank (2023) and Varo Bank (2024): once attackers have clean identity and account data, the next logical step is to walk that data through fintech and credit products, not just use it for brute force logins. Fraud volumes stay deliberately low to avoid bot and velocity checks, which means the quality of each identity matters more than the number of attempts.<ol start="2"><li class="ck-list-marker-bold" data-list-item-id="e4099d29e094fa4197a6b364197005a60">Tipping and post-settlement edits are an attractive fraud surface</li></ol>A second pattern involves how cards handle tips and post-settlement changes. MoneyLion has been fighting a recurring fraud method where a fraudster:<ol><li data-list-item-id="e1962e138bd4e963d4fd6814bbe4dcf8f">Acquires or controls a bank account with a small balance, for example, five dollars.</li><li data-list-item-id="e2bf91adc4b348ee9131f256dbda3431a">Seeks authorization for a tiny transaction, often one dollar, which easily passes.</li><li data-list-item-id="e8bd6a6b5960bb9b0b1f879d03209d74f">After authorization, the settlement amount dramatically increased, for example, to fifty thousand dollars.</li></ol>Because the authorization has already gone through, the system often treats the later settlement as approved and pushes the burden of recovery into slow dispute processes. In Q4, two incidents illustrate the impact:<ul><li data-list-item-id="e3d97b724ce1daf63e2de9de11ea794f2">In October 2025, one actor used this method to create potential losses of around 33,000 dollars.</li><li data-list-item-id="e713b00e13a03a1837e3a29f8721f0378">In November 2025, a single user caused about 16,000 dollars of loss in a single day while on a cruise.</li></ul>On a monthly basis, forced post-settlement abuse still represents a small share of overall revenue, measured in a few basis points. This approach exploits a feature originally designed for hospitality and tipping, where post-transaction adjustments are normal. If platforms let new or lightly vetted merchants perform large modifications without extra checks, a handful of actors can repeatedly convert one-dollar tests into five-figure hits.

&nbsp; &nbsp;3.&nbsp; &nbsp; Microtransaction disputes blur the line between customer and fraudsterMicrotransaction abuse shows up at the intersection of creators, social platforms and financial apps. The basic approach looks like this:<ul><li data-list-item-id="e0d94f673cb2c70c4583ecb242b260d6e">A user connects a bank account to a money app,</li><li data-list-item-id="ecdf376ca3acfcfdaecbe826c5255c33c">They send a high volume of small tips or purchases to a creator on platforms such as TikTok or Meta,</li><li data-list-item-id="e9d98b9ae3cae5052220e968381fce719">Once the funds have cleared, they dispute all the transactions, claiming they were unauthorized or that goods were not received.</li></ul>Sometimes the creator is an unwitting victim, seeing their income clawed back. In other cases, there is a collusion between the account holder and the creator, who split the proceeds. Either way, the economic incentive for banks and processors is often to accept the disputes, because fighting thousands of small chargebacks costs more than writing them off.MoneyLion’s view is that, since January 2025, the use of microtransactions has been rising across gaming and social platforms, and in some months, dispute volumes linked to this behavior can balloon into the 20,000 to 30,000 dollar range if all those transactions are auto-approved and later contested. That is real money at the scale of a single merchant or creator ecosystem.From a financial wellness perspective, this is where first-party fraud stops being a rounding error. People are being coached online to treat chargeback abuse as a “trick” against big platforms, not as fraud that raises costs for everyone. At the same time, some genuine consumers, including families managing kids’ in-app spending, are nudged into overspending through manipulative in-app purchase design, then fall back on disputes when bills arrive. Both sides push more friction and higher fees into the system.

&nbsp; &nbsp;4. &nbsp; &nbsp;Phishing and account takeover still drive the biggest direct lossesThe most traditional pattern in MoneyLion’s data is also the most expensive: SMS phishing that leads to full account takeover. The recent waves share a familiar anatomy:<ul><li data-list-item-id="ec05dd658f05d5045bceb2652a5c48457">Attackers obtain phone numbers and partial identity data for real customers, often from breaches at other financial institutions or data brokers.</li><li data-list-item-id="e08d4729f3a58c76836c8b08351cc32a5">They send localized SMS messages that mimic MoneyLion alerts and direct people to a fake login page,</li><li data-list-item-id="ebe1ad55a9eed32650608941d3f5f982c">The fake page collects credentials and one-time passcodes, which are then replayed immediately against the real service.</li></ul>This method has the potential to cause substantial losses, even when baseline verification and risk systems block many attempts. In response, MoneyLion applies a layered approach that escalates checks at the moments of highest risk, including targeted re-verification when activity deviates from legitimate patterns. The tradeoff is friction; stronger checks can occasionally surface for legitimate customers. Looking ahead, that balance will get harder as AI-assisted fraud attempts improve at spoofing identity signals, increasing the need for resilient liveness and deepfake-aware verification. Across incidents, device profiling also showed consistent environment indicators, including repeated locale and input-setting artifacts, but these signals should be treated as investigative context, not attribution.These campaigns also tie back to the broader identity picture in this report. The same compromised phone numbers and partial profiles that make WhatsApp or banking phishing so effective are often sourced from earlier breaches or data sales. Once an attacker can get a customer to hand over a temporary code, every other safeguard has to be fast and precise enough to recognise the session as abnormal in real time.MoneyLion’s answer has been to invest in stronger multi-factor orchestration and alternative authentication methods that are harder to replay through phishing proxies, for example, device-bound approvals and more aggressive step-up checks when fresh devices or locations appear.<h4 class="text-align-justify">What this adds up to for financial wellness</h4>Taken together, these patterns show financial fraud moving closer to everyday behavior:<ul><li data-list-item-id="ed94ca1b90ea0da5c1e283cb8f21118d0">Stolen identity data is being spent first on high-quality onboarding attempts, not only on brute force logins.</li><li data-list-item-id="eaf5d8ad8af3d6eb49a592bfa0281a14e">Legacy payment features such as tipping and post-settlement edits are being bent into tools for outsized paydays.</li><li data-list-item-id="edd82ef96ae7d037201da06f56938487f">Microtransactions and creator economies create fertile ground for chargeback abuse and collusive “friendly” fraud.</li><li data-list-item-id="eb778f3415db6e3be1bac3f3d6e19488f">Classic phishing and account takeover remain a primary driver of direct dollar losses, powered by recycled identity data and convincing lures.</li></ul>For Gen, MoneyLion’s signals let us see those risks at the moment they touch real customers: when an application is blocked before funds move, when a one-dollar test suddenly settles as a five-figure charge, when dozens of micro tips are quietly disputed, or when an SMS lure turns into a drained account. That is where financial wellness is decided in practice, not in a spreadsheet of average balances, but in the repeated small moments where people either keep control of their money or quietly lose it.Patrik Holop, Associate Manager, Data Science Luis Corrons,&nbsp;Security Evangelist<h2>Featured Stories:&nbsp;how current threats play out in real life</h2>The numbers in this report show how large the problem has become. These stories show how threats come to life in our daily lives. Each of the following featured stories zooms in on a specific campaign or technique we investigated in depth, from account takeovers spreading through trusted apps to AI-shaped scams and media manipulation designed to make people hand over control of their device or account with a single tap or scan. The common thread is not a particular piece of malware, but a pattern of behavior. Attackers exploit familiar brands, everyday tools and believable scenarios, then use automation and AI to scale those tricks across millions of people. These cases reveal where attackers are concentrating their efforts, what defenses have proved effective, and which risks are likely to accelerate in the year ahead.<h2 class="text-align-justify">How AI made video scams personal, one viewer at a time</h2>

We live in a digital feed that never sleeps. Within a few years, our habits have shifted from group chats and photos to an always-on stream of short and long videos, social posts and streaming. YouTube has become a fixture of living-room TV time in many countries, and is no longer just a mobile pastime. In August 2025, it captured <a href="https://www.yahoo.com/news/articles/youtube-tv-viewership-streak-continues-120000274.html?guccounter=1&amp;guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&amp;guce_referrer_sig=AQAAAG8OIgGxXI3s83CwHnvwudXD8DPRK63Hy9F6YZCJkGYm17g444YvKv_lKEz_pNN9Ame8XSB_kH1VGY2xAj-oAUFrMLZvqfdgxoLpGD_RVuUF-kCjab9JXx9gPKq8vnNhG3D_GsSE18dKKZoM9jc8OmwnM3ZkhkYxpdKb6MO_cWhu" target="_blank">13.4% of all U.S. television viewing</a>, its second-highest share on record, a clear sign of how mainstream video creators have become stars in homes across the country. In the UK, regulators report that 41% of YouTube viewing happens on TV sets, another sign that social video has migrated from phones to sofas. Streaming overall keeps expanding its share of home TV use, and that shift brings more advertising and recommendation engines into connected TV, shaping what people see next.&nbsp;At the same time, AI has quietly carved out a key role in video production. AI is no longer a novelty technology; it is often the most important tool for creators and marketers. Adobe’s latest global survey found <a href="https://news.adobe.com/news/2025/10/adobe-max-2025-creators-survey" target="_blank">86%</a> of creators are using generative AI somewhere in their workflow, and most say it allows them to create content they never could before. Analysts forecast that a growing share of outbound marketing messages will be synthetically generated, which means persuasion at scale will arrive with fewer human bottlenecks. Put simply, a larger portion of the videos that reach people will have AI fingerprints on them, whether that is to clean up audio, generate B-roll, clone a voice, or stitch a composite face or content that combines all of the above.Criminals always follow the audience and the tooling. The same advances that let a small team produce studio-grade content also let a small criminal crew fabricate a convincing plea for money or a fake endorsement. That does not always mean chasing virality. It often means crafting clips that look and sound intimate enough to convert a small group of potential victims.<h3 class="text-align-justify">What the data shows</h3>In the second half of 2025, we added on-device video scam detection to our Windows protection. The goal is simple: focus on content intending harm, not just novelty, and flag videos where manipulated media and scam intent come together.&nbsp;The feature is new and not on every device yet, so results reflect where we have coverage, for example, which platforms and countries have more users with it. To keep the picture fair, we show shares by platform and country, not absolute numbers.&nbsp;YouTube dominates the overall share of blocked AI scam videos, followed by Facebook as a distant second, and X in third place. The most danger comes from longer, engaged watches as opposed to short snippets. This lines up with where attention sits today, many people consume creator video in lean-back sessions on TVs and PCs, which gives scammers longer windows to persuade.&nbsp;

In our Q4 telemetry from Windows devices where this feature was enabled, the distribution of blocked AI scam videos was highly concentrated on a small set of platforms. YouTube accounted for 64.8% of blocks, followed by Facebook at 11.1%. Other platforms each represented a small share in this dataset, including X (0.5%), TikTok (0.4%), Vimeo (0.2%), and Instagram (0.1%). These shares should be read as where blocks occurred within covered Windows PCs, not as a ranking of overall platform risk across the internet. Mobile-first viewing and app-only behaviors are not captured here, which can materially underrepresent platforms that are primarily consumed on phones.This is not a verdict on those platforms at large; it is a reflection of where our customers actually encountered scam videos when on their PC. The dominance of YouTube likely reflects where people spend their video hours, and how recommendations string clips together in longer sessions on TVs and PCs.By country share of blocked AI scam videos, the United States leads, followed by Australia, the United Kingdom, Canada and Germany. All other countries together make up a bigger share than any single country. We treat this as a ranking of where our protection intercepted scams, not a map of overall risk, because results still depend on where the feature is installed and most widely used. As adoption grows, we will add a per-user risk view, users with at least one block divided by active users with the feature.

We stopped most attacks in real time during playback. These scams appeared during playback – while you watched the video – not in downloads or attachments.&nbsp;Most scam videos blocked were general scam content, with financial and cryptocurrency lures close behind. In other words, AI manipulation is not the entire scam but a working part of a larger money play. We are continuously working on refining the automatic classification of these scams to have more granular insights.&nbsp;<h3 class="text-align-justify">AI itself is neutral. Danger comes from intent</h3>There is far more AI-generated or AI-edited video in the wild than outright scam video. That is expected and healthy. The presence of AI in a clip is not a useful risk signal on its own. Much of what AI does is benign or even helpful, for example, noise reduction, captioning, translation, and providing stock footage. The risk appears when AI capability is paired with a request for money, data, an urgent ask or an off-platform handoff – when AI and the scam meet.This is why our telemetry tracks only the intersection: AI-made or AI-assisted media that is also a scam.&nbsp;In Q4,&nbsp;on devices where the feature was enabled, we detected 159,378 unique deepfake video scam attempts within this intersection,&nbsp;most of which&nbsp;blended into ordinary content, often voice-led clips embedded in otherwise normal videos. In the smaller, clearly labeled set, the top themes are money-related, finance and crypto.&nbsp;As AI becomes the default ingredient in media production, the right way to judge risk is by intent and behavior, not by whether AI touched the file.

<h3 class="text-align-justify">What the signals suggest:</h3><ol><li data-list-item-id="e7f3231e6b5edfe1418f60aacedcb8a1c">Scammers follow the audience. Wherever people spend time watching videos, that is where scammers go. If they can slip their content into normal playlists on the biggest platforms, they do not need huge view counts. They only need to look believable enough for a small percentage of viewers to fall for it.</li><li data-list-item-id="e254bd855999ddfb48a99f05758ed5eb3">Finance remains the North Star. Our detections show a strong concentration of investment, trading, and giveaway content. This mirrors broader shifts in digital media spend, where AI-targeted ads and calls to action are flooding connected TV and social video. The same tools that amplify legitimate campaigns are also lowering the barrier for fraud.</li><li data-list-item-id="e498e39ba881d8a292a83ab80460e6c99">AI is normal, so AI misuse is normal too. With creator-level adoption this widespread, it would be surprising if criminal crews were not using the same tools. The difference is intent. Our detections focus specifically on AI-touched media that is also a scam, not every video that happens to include AI.</li></ol><h3 class="text-align-justify">Why this matters for consumer harm</h3>The risk is not just the astonishing fake. It is the ordinary-looking clip that blends seamlessly into your subscriptions. A cloned voice reading a script over stock footage is enough to move money when it is seen next to a trusted logo or comes from a familiar face or a creator you already follow. &nbsp;This represents a very different problem from yesterday’s focus on spotting viral deepfakes.<h3 class="text-align-justify">What people can do right now</h3>Beyond using deepfake protection products, here’s a list of actions that can help protect you across platforms:&nbsp;<ul><li data-list-item-id="ed5e924f49954d4b79723f2675a107b37">Do not trust a clip to stand on its own. If it asks you to move money, pause and switch channels. Verify through a known contact method or an official website you type in yourself.</li><li data-list-item-id="eadde55fbaf50aada8bbace50bb860e4a">Ignore urgency and exclusivity. Timers, limited slots, or “only for subscribers” offers are classic pressure cues for investment and giveaway scams.</li><li data-list-item-id="e0a458a289fe7f0919089e948e7ce2a95">Check audio more than visuals. Many scams hinge on cloned or stitched audio. Listen for pacing that never breaks, awkward breaths, and mismatched tone or echoes.</li><li data-list-item-id="e01fb8612979a2e07ce2e6da63d304521">Treat QR codes and pinned comments as links from strangers. Search for the destination yourself instead of scanning codes and clicking links.</li><li data-list-item-id="eed7c9767acc12473ecee649631576ac7">Report and move on. If you spot a scam, report it. Platform reporting helps downrank bad content faster and reduces the chance others will see it.</li></ul>Criminals do not need a million views; they need the right viewer at the right time. Audio is the quiet driver. Cloned or heavily edited narrations can project authority or urgency, while ordinary visuals avoid attention. Together, this lowers skepticism, exploits fluency bias and presents the message as guidance rather than persuasion. A clip labeled as an interview or a tutorial feels safe, especially if the voice sounds familiar, even if the visuals are generic or the proof is just an overlay. &nbsp;That dynamic helps explain why almost all intercepts happen during playback, showing where protection is most critical.AI is now normal in content production, and there is likely no turning back from this – rather, the inclusion of AI in the media we consume will only increase. The question is not whether AI is in the loop; it is whether the clip uses AI to push a fraudulent action. This is our first share-based read on AI-made or AI-assisted scam videos across platforms and countries, and it lets us set a baseline and move from anecdotes to patterns. You will see these figures evolve as adoption grows, and we will keep calling out two things clearly in future quarters: where people are actually getting hit and which lures are costing them money.&nbsp;<h2 class="text-align-justify">Love at machine speed</h2>At one time,<a href="https://www.avast.com/c-romance-scams" target="_blank"> romance scams</a> were clumsy cons, full of spelling mistakes and obvious lies. That changed the moment AI learned to play humans. Today, a scam can arrive in your inbox as a fully formed character, complete with a believable face, a convincing voice, a life history, and a pattern of small, attentive gestures that feel, to the target, exactly like falling in love.

Imagine the scene: You match with someone on a dating app. Their profile pictures are glossy but intimate, a mix of sunny holidays, a coffee shop selfie, a dog framed by a living room bookcase. Their messages are clever – they remember details about your weekend that you barely mentioned, and they send sweet voice notes that sound warm and somehow familiar. Over a few weeks, the conversation deepens, the stranger remembers that you prefer black coffee, asks about the scar on your knee, and sends a private clip where they say your name. It all feels painfully real. Unfortunately, what you are experiencing is not human love; it is an engineered performance, orchestrated by AI tools that fill in every gap where human deception used to stumble.What makes today’s romance scams so effective is not just the synthetic photos or the cloned voices. It is the emotional precision. In psychology, you sometimes see this described as a “dark empath,” someone who can read your cues and mirror your emotions but uses that insight instrumentally to manipulate you. AI helps scammers mimic that behavior at scale, remembering tiny details, matching tone, and timing warmth or vulnerability so it feels like real care, right up until the ask arrives.&nbsp;Although we often speak about this type of con in relation to dating apps, the same playbook runs across mainstream social media. You can meet an almost perfect partner on Facebook, trade DMs on Instagram, stumble into a flirty TikTok live, or move a chat from X into a private channel, and the mechanics do not change. AI supplies the photos, voice notes, and short videos. The account looks lived in with a few reposts and friendly comments, and the conversation builds the same rhythm of attention and trust. The pivot comes later – a request for money, a verification link, a parcel fee, or an intimate exchange that later turns into extortion. Regardless of the platform, the script is the same.<h3 class="text-align-justify">Different stories, same end goal&nbsp;</h3>Before naming specific schemes, it helps to recognize the pattern. First, the relationship feels real. The details stay consistent across photos, voice notes, short videos, and even documents. Then the story branches. Some paths guide you toward “safe” investments. Others steer you to verification pages that harvest IDs or payment information. Some rely on urgency, using a voice that sounds like a loved one, while others turn intimacy into pressure and threats. These flavors often overlap. Criminals pivot as soon as you hesitate. The goal is always the same: turn trust and emotion into money or data. Below are the most common variants, with plain explanations and simple examples you can recognize in the wild.<ol><li class="ck-list-marker-bold" data-list-item-id="e4a87fd3a24ff95050acfa5629d947fb6">The classic romance turned investment trap – pig butchering</li></ol>What starts as a genuine emotional bond gradually shifts into financial manipulation. The scammer, posing as a caring partner, introduces the victim to a safe investment or crypto opportunity. The app or website looks legitimate, shows fake profits, and once the victim invests more, everything disappears.Example: After weeks of flirting, your new partner persuades you to test an exclusive trading platform. You top up, and the site disappears with your money.<ol start="2"><li class="ck-list-marker-bold" data-list-item-id="ef8315ac63de23c390c69bd9092028585">Deepfake lover or influencer impersonation</li></ol>Scammers use AI-generated photos, videos, and voice clones to impersonate attractive strangers or even celebrities. These fakes feel personal and intimate, convincing victims they are speaking to someone real.Example: A short clip arrives with a familiar face saying your name, inviting you to a private chat that leads to paid perks.<ol start="3"><li class="ck-list-marker-bold" data-list-item-id="ee2613e7b3a223fec51b41c61504d5b2c">Sextortion through synthetic intimacy</li></ol>Here, the scam escalates quickly. After some flirtation or exchange of images, the victim receives a doctored photo or AI generated video that appears to show them in a compromising situation. The criminal then demands payment to keep it private.Example: A blurred video appears to show your face on someone else’s body, followed by a threat: pay or I will send this to your contacts.<ol start="4"><li class="ck-list-marker-bold" data-list-item-id="edac4907c839fd8d30190b8a6969300df">Reciprocal sextortion, AI-assisted trust building</li></ol>The scammer sends AI-created nudes first to lower defenses, promises reciprocity, then pressures the victim to send real images. Once the victim complies, the scammer extorts them using those real photos.Example: Someone on a dating app offers to prove trust by sending a nude; it looks real thanks to AI. You send one back, then receive demands to pay or it will be shared with your contacts.<ol start="5"><li class="ck-list-marker-bold" data-list-item-id="e07a9c5c19efac9df0c1e67600499107e">Voice cloned loved one in distress</li></ol>A few seconds of audio are enough to create a believable call from a partner or family member, claiming to be in an emergency and needing immediate help.Example: A frantic call that sounds exactly like your sibling, claiming they are stuck overseas and need cash for a hotel or medical bill.<ol start="6"><li class="ck-list-marker-bold" data-list-item-id="e4a463aa7393ccc73ce019964b562db2d">Fake verification or dating platform scams</li></ol>The lure is safety and trust. The scammer asks you to verify your identity on a separate site, which actually collects payment details and personal information.Example: To keep us both safe, please verify your profile here. The site looks official, but it is a front to steal your card data.<h3 class="text-align-justify">What falling for these scams actually costs</h3>The damage is wider than a single transfer. It usually includes direct financial loss, ongoing blackmail or harassment, identity theft from “verification” flows, account takeovers, and a long tail of recovery costs and stress. At the population level, the losses are substantial.&nbsp;The&nbsp;<a href="https://www.fbi.gov/news/press-releases/fbi-releases-annual-internet-crime-report" target="_blank">FBI’s Internet Crime Complaint Center</a> recorded more than 16 billion dollars in reported cybercrime losses in 2024, a 33 percent jump over 2023, and notes that the true figure is likely higher. The U.S.&nbsp;<a href="https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024" target="_blank">Federal Trade Commission</a> reported 12.5 billion dollars in total fraud losses in 2024, up 25 percent year over year, and highlighted that scams starting online account for billions of those losses. Within that, romance scams remain among the costliest imposter scams, with 2023 reports alone totaling <a href="https://www.ftc.gov/business-guidance/blog/2024/02/love-stinks-when-scammer-involved" target="_blank">1.14 billion dollars</a> and a median loss of 2,000 dollars per person. Older adults are hit hard: an FBI report tallied more than&nbsp;<a href="https://apnews.com/article/c0da7899f667f9daace4926d5ff3f427" target="_blank">3.4 billion dollars</a> stolen from Americans 60 and over in the latest year, with thousands losing over 100,000 dollars each.&nbsp;Loss is not only about money. Sextortion cases bring sustained threats, reputational harm, and doxxing attempts. Identity documents uploaded to fake “safety checks” can be reused for new accounts and loans. Voice-clone emergencies corrode trust inside families and, in extreme cases, trigger dangerous real-world confrontations. Finally, victims are often targeted again by “recovery” scammers who promise refunds for a fee.<h3 class="text-align-justify">What our telemetry shows in 2025</h3>Many attacks that start with a romance setup pivot quickly into other scams, for example, investment portals, sextortion, refund or parcel fees, or fake verification that harvests IDs. We tag an event as “dating-scam” only when the lure or page clearly uses a romance or dating pretext. If a conversation shifts early into investments, parcel fees, refund tricks, fake verification, or generic phishing, it is blocked under other categories. In other words, the dating-scam data understates the true volume of attacks that begin with a romantic hook.In recent months, we have seen a steady rise in romance-themed scam attempts in our telemetry, as reflected in the below graph. There were over 17 million dating scam attacks blocked in Q4 2025, an over 19% increase from the same period in 2024.&nbsp;

<h3 class="text-align-justify">How to stay safe, without killing the mood</h3>You may be thinking: Do careful people still fall for these types of scams?&nbsp;The answer is a resounding yes. These scams target judgment, not knowledge. When photos, voice notes, videos, and paperwork all line up, our brains overweigh coherence. AI is excellent at making everything feel seamless. The fix is not paranoia; it is adding small moments of friction where reality is forced to show up.First, treat any money request inside a romantic context as high risk. Pause between the message and any payment, even if the amount is small or framed as a refundable fee. If you need to verify a person, do it with a live, unpredictable check that is hard to pre-record. Ask them to join a video, write a phrase you choose on paper, hold it with both hands visible, then pan to a nearby window or street sign. If the connection is always too poor for that, keep your guard up. When someone invites you to invest, only use platforms you already trust and reach on your own, not links sent in chat. Refuse off-platform verification pages. For parcels, type the courier website yourself, and do not click tracking links sent in DMs.Set a personal rule not to send explicit content. Scammers now send convincing AI nudes first to lower defenses. The goal is to make you send something real, then quickly change the conversation to threats. If you already shared something intimate and are being extorted, stop contact, save evidence, report the account on the platform, and file a report with local authorities. Payment rarely ends harassment and often increases demands. Tell a trusted friend so shame cannot be used against you.Real love online exists. That is exactly why these scams work. You do not need to switch off your heart to stay safe. Just keep three habits at the top of your mind: pause before paying, verify on a channel you control, and refuse high-risk moves on someone else’s schedule. These small steps are enough to break most scripts.<h2>The code that steals your WhatsApp&nbsp;</h2><h3 class="text-align-justify">How device linking enables takeover, persistence, and rapid spread across your contacts</h3>You are chopping vegetables when your phone buzzes. A WhatsApp from a friend you trust. “Hey, I just found your photo!” The preview shows what looks like a Facebook post. You tap.

The page looks familiar, clean and a bit boring, which is exactly the point. There is a Facebook login box, then a blue button that says you need to verify to view the photo. When you press it, the next screen shows a six-digit code and a short instruction telling you to open WhatsApp and enter it to confirm the login.You want to get back to dinner, so you do what the page tells you. A second later, nothing obvious happens, so you put the phone down.What actually happened is the whole story.<h3 class="text-align-justify">What the attacker just got</h3>That code was not a Facebook thing. It came from WhatsApp’s own device linking feature and it belonged to the attacker’s browser. When you entered it in WhatsApp, you quietly granted the attacker a live session to your account. They can now read your chats, see new messages arrive in real time, and write to your contacts as if they were you. No SIM swap, no code theft, no forced logout on your phone. It feels invisible because WhatsApp treats that browser as one of your own devices.<h3 class="text-align-justify">How the trick actually works</h3>Most people think linking WhatsApp Web only works by scanning a QR code. WhatsApp actually has a second method for pairing devices, one almost nobody knows about: linking a device using only your phone number and a numeric code sent inside the app. It was designed as a convenience feature, but it looks so similar to a standard security confirmation that attackers have turned it into the perfect social engineering tool.Here is what really happens in the background. When you land on the fake Facebook page, the site forwards your phone number to the real WhatsApp Web linking flow. WhatsApp then generates a pairing code that the rightful user must enter in the app to approve the new device. Instead of keeping that code on their own screen, the attacker simply prints it on the fake page and tells you that you must “confirm this login in WhatsApp to view the photo.” To most people, this looks like a normal verification step, the kind you see every time you log in somewhere.

The moment you enter that number into WhatsApp, you are not verifying anything related to Facebook. You are authorizing a new linked device and giving the attacker’s browser the same level of access as your own laptop. That is why this takeover feels so clean. There is no password theft, no malware, no obvious alert. The attacker just slips into your account and quietly becomes you.Technically, the same abuse is also possible with QR-based linking. In practice, however, that is much harder to drive at scale when both the browser and WhatsApp run on the same phone. Asking people to deal with a numeric code on screen is far more realistic, which is why the campaigns we see rely on the phone number plus pairing code flow.For a deeper technical walkthrough of the device-linking abuse, including additional examples and infrastructure details, see our supporting blog post, “<a href="https://www.gendigital.com/blog/insights/research/ghostpairing-whatsapp-attack" target="_blank">GhostPairing Attacks: from phone number to full access: abusing WhatsApp’s device linking.</a>”<h3 class="text-align-justify">How the snowball forms</h3>While you finish dinner, the attacker gets busy. Your family group receives the same short message and link. So do your school chats, your work chats, and the neighbor who checks your dog. The words feel like you wrote them, short and casual, so people click. Each new victim goes through the same “verification” step, entering their own pairing code in WhatsApp and linking a new attacker-controlled browser. Each account becomes another megaphone. That is why this spreads fast. It is not a random number texting you. It is a friend.If anyone reports you for spam, WhatsApp may temporarily limit your account. That helps, but it does not remove the attacker’s linked browser. When the limit expires, the session is still there unless you manually revoke it. Persistence is part of the playbook.<h3 class="text-align-justify">Why this technique matters</h3>End-to-end encryption protects messages in transit, but device linking changes the threat model. A single scan or code approval gives the attacker the same view of your chats that you see on your laptop. Once inside, they do not need to rush. They can watch, learn who your closest contacts are, and wait for the perfect moment. A voice note you recorded last week becomes training data for a voice clone. A holiday photo becomes the backdrop of a payment request that looks and sounds exactly like you.We refer to this pattern as a GhostPairing Attack. The attacker’s browser becomes a kind of ghost device on your account, present in every conversation, even though you never see it on your phone.The scam starts as a two-minute trick. It evolves into slow, patient social engineering supported by the kind of personal data only a compromised WhatsApp account can provide.<h3 class="text-align-justify">Inside the kit</h3>Everything about this flow suggests a packaged kit. A short lure localized for a specific country. A generic Facebook skin. A reusable linking step that connects directly to WhatsApp’s legitimate device pairing logic. The domains are disposable and interchangeable, from photobox[.]life to yourphoto[.]world to postsphoto[.]life. Tomorrow, there will be new ones with the same HTML and a different logo. This is production line fraud.<h3 class="text-align-justify">What to do right now</h3><ol><li data-list-item-id="eff946c84183c0e06565922397aeebba6">Open WhatsApp, go to Settings, Linked devices, and log out of any device you do not recognize. If you see a desktop browser you never use, remove it.</li><li data-list-item-id="e9f496a802fac4d1657997abf34ca7e7d">Turn on Two-Step Verification in WhatsApp and set a unique 6-digit PIN. Add a recovery email so you can reset the PIN if needed.</li><li data-list-item-id="e6ffaea11f69d4cd590608aec2a873a87">Treat any code or QR that asks you to link WhatsApp as sensitive. If a website says you must link WhatsApp to view a photo or parcel, close the tab.</li><li data-list-item-id="ef3ab296a2af9f6bd2753baeb3ccde1be">Share a simple warning in your family or school groups. People listen when it comes from someone they know. A single screenshot of the lure plus the linked devices instructions is often enough to stop the chain.</li></ol>&nbsp;<h3 class="text-align-justify">What platforms can fix</h3>This attack succeeds because pairing is too easy to misdirect and too sticky once granted. Three changes would reduce the impact significantly. • Show a clear warning before linking that names the browser, location, and context. • Rate limit linking attempts by browser fingerprint and region to stop mass campaigns. • Auto-unlink unknown sessions when an account is rate-limited for spam.<h3 class="text-align-justify">The takeaway</h3>What makes this scam dangerous is not the message or even the fake page. It is how invisible the compromise is. One quick scan links your WhatsApp to someone else’s browser, no malware required. From there, every private chat becomes an open door, every trusted contact a new target. The same mechanism could be reused anywhere device linking exists, from messaging apps to productivity tools.The moment you approve the link, your account becomes a broadcast channel and a data source for future pressure. The defense is simple once you know it exists. Check linked devices, remove strangers, and think twice before entering a code or scanning a QR that is not inside the official WhatsApp app.&nbsp; &nbsp;Luis Corrons,&nbsp;Security Evangelist Martin Chlumecký, Malware Researcher Patrik Holop, Associate Manager, Data Science<h2 class="text-align-justify">In Closing</h2>&nbsp;As we close this report, one thing is clear: the threat landscape is not chaotic; it is consistent. The tools and brands may change, but the core playbook does not. Criminals lean on trust, routine and speed. They show up in the same browser where you watch tutorials, in the same chats where you talk to family, in the same apps where you check your balance. The most damaging attacks are the ones that feel like everyday tasks until one small decision goes wrong.Across the telemetry and examples in this report, there are three main threads. First, many attacks only work if people do the last step themselves: installing the file, scanning the QR code, approving the pairing, and entering the code. Second, AI has become part of the plumbing on both sides, quietly shaping scams and defenses rather than acting as a headline feature. Third, the harm is increasingly counted in identities and money, fake partners, fake professionals, bad loans, drained accounts and long recovery journeys, not just in machines cleaned and files restored.The good news is that the same patterns that make these attacks scalable also give us repeatable ways to break them. Small moments of friction, clearer warnings around device linking, stronger defaults for privacy and tracking, better authentication flows, and protections that watch what content is trying to make you do, not only where it came from. Our own data from browsers, devices, identity alerts and day-to-day money decisions shows that when those safeguards are in place, many of the “Scam Yourself” tricks simply fail to land.None of this removes the need for skepticism. There will always be a new lure, a fresh logo, a more polished voice or video. But you do not need to chase every novelty. If you treat rushed requests, unexpected verifications and off-platform handoffs as high risk by default, you already cut off a large share of what we see here. A short pause, a second channel to verify, and a habit of saying no to surprise links are still some of the most effective defenses most people have.Thank you for taking the time to explore this report. The work behind it comes from researchers, analysts, engineers and writers across Gen who spend their days trying to translate complex signals into something useful for real people. We hope it helps you understand not just what criminals are doing, but how to stay one step ahead of them in the places where you actually live your digital life.

<h2 id="download-the-q3/2025-threat-report-key-highlights">Download the <a href="https://www.gendigital.com/blog/sites/default/files/2026-01/Q42025%20Threat%20Report%20Key%20Highlights.pdf" target="_blank">Q4/2025 Threat Report Key Highlights</a></h2>Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

Fake ads dominated consumer cyberthreats in 2025

Gen Q4/2025 Threat Report

<h3>When you get a message you didn’t expect, and definitely didn’t want</h3>You're having a normal day when your phone buzzes with a new message: "Your parcel couldn’t be delivered – reschedule now: [shortened link]" It even comes from the same thread where you previously got updates from your real delivery company. Seems legit, right?It’s not.That message wasn’t from your courier. It was from a scammer pretending to be one. And if you click the link, enter your details, or install a suggested “app,” you could end up with a drained bank account, lost data, or unwanted spyware or other dangerous applications compromising your device..In this blog, we’ll break down:<ul><li>What SMS threats really are</li><li>The most common types of scams you’ll find in your inbox</li><li>What scammers are searching for</li><li>How to spot scams (and what to do) if one shows up on your phone</li></ul>We’ll even show you real-world examples of these scams in action.<h3>What is smishing?</h3>SMS is the technical acronym meaning Short Message Service – in many places around the world, people refer to SMS messages simply as text messages or texts.&nbsp;Smishing is short for SMS phishing. It happens when scammers use text messages to trick you into taking an action: usually clicking a malicious link, downloading an app, sending a code, or replying with personal or payment information.Sometimes these messages pretend to be your bank. Other times, a government agency, delivery service, family member or even someone offering a too-good-to-be-true job. These messages are designed to look urgent, convincing, and familiar, so you act before thinking.🧠Why SMS? Because it works. We check texts quickly, we trust them more than email, and many phones automatically group texts into brand-labeled threads – making it even easier for scammers to sneak in undetected.&nbsp;<h3>Why you’re seeing more of these messages now</h3><ul><li>Phone numbers are everywhere. Have you shared your number for a raffle? Coupon code? Loyalty card? On social media? That’s all it takes.</li><li>Global scams are industrialized. These are not one-person operations. Criminal groups now run massive SMS campaigns using stolen or breached databases, message automation, and spoofed sender IDs.</li><li>Smartphones are now wallets. With banking, two-factor authentication (2FA), and shopping on your phone, it’s a prime target for fraudsters.</li><li>They only need a few people to fall for it. And statistically, someone always does.</li></ul><h3>The many faces of SMS threats</h3>Let’s walk through the most common SMS scam types. For each one, we’ll explain how it works, what the scammers want, and what you should do.&nbsp;1. The fake account alert (banks, email, crypto, social)Hook: “Unusual login detected” / “Your account is locked” / “Urgent security check.” Goal: Steal your username, password, and possibly 2FA code. How it works: Link opens a perfect copy of a login page (bank, email, crypto exchange). Some variants tell you to call a number to “secure” your account. What to do: Don’t tap. Open the official app or type the address yourself. Never call numbers in the SMS. If you logged in, change your password and enable an authenticator app for 2FA.

2. The OTP (code) theftHook: “Reply with the 6-digit code to cancel your transaction” / “We sent a code to secure your account – please confirm.”&nbsp; Goal: Steal your one-time password to break into your account. How it works: Scammer triggers a real OTP from your service and tries to trick you into sharing it. What to do: Never share codes. If you didn’t request it, someone else probably did.

3. The undelivered packageHook: “We couldn’t deliver your package – pay €1.50 to reschedule.” Goal: Harvest credit card info or trick you into downloading malware. How it works: You’re sent to a fake delivery site with a small payment form or prompted to install a “tracking app” (especially on Android). What to do: Don’t follow the link. Track packages only via the delivery company’s official app or website.&nbsp;

4. The tax refund or fineHook: “You have a tax refund waiting– claim now.” Goal: Payment and identity theft on a convincing look-alike site. How it works: Uses branding from national tax offices, toll agencies, or other government institutions. Creates a sense of urgency with strict deadlines, and asks for card + personal data. Some texts use weird characters to bypass filters. What to do: Always access government and other official &nbsp;portals directly from the official site.&nbsp;

5. The fake refundHook: “You are owed a refund for your flight– click here to claim.” Goal: Steal credit card details, ID info, or sign you up for paid services. How it works: Polished “claim” page with language that creates urgency. Some use homoglyphs (look-alike characters) in brand names to seem legitimate. What to do: Check your account or booking site directly– never through a link in a text.

6. Jobs &amp; side gigs (“mystery shopper”, “brand recruitment”)Hook: “Earn $200/day from home. No experience needed!” Goal: Get you to move to WhatsApp or Telegram and then steal personal info or scam you into paying “recruitment fees.” How it works: Friendly recruiter builds trust, then pressures you into sending personal documents or paying small fees to "start." What to do: Treat unsolicited job texts as scams. Verify roles on official careers pages; never pay to apply.&nbsp;

7. The crypto or investment baitHook: “Hot crypto tip! Double your money in 7 days.” Goal: Move you off-platform and scam you into depositing funds. How it works: Often starts with an SMS and continues on WhatsApp or Telegram. What to do: Ignore unsolicited tips. Real investments don’t arrive by random text.

8. Cloud storage &amp; account expiration scamsHook: “Your storage is full– photos tied to your number will disappear.” Goal: Steal account credentials or payment details; sometimes push you to install a malicious app. How it works: The message warns that your cloud account is about to expire or that photos will be deleted unless you act now. Victims are directed to a fake login page (to harvest credentials) or to a payment form (to steal card details). Some versions even include your phone number in the message to make it feel personal. What to do: Don’t click the link. Instead, check your cloud account directly through the official app or by typing the provider’s website yourself. If you entered your login on a fake page, change your password immediately and turn on two-factor authentication. If you installed an app, uninstall it and run a trusted security scan.

9. The “your phone is infected” / fake tech supportHook: “Phone infected– install our security app” / “Call support now.” Goal: Install a rogue app or gain remote control of your device. How it works: Provides a fake antivirus/security product page, sometimes customized to your device. What to do: Don’t install from links. Use official app stores; never grant remote access to strangers.

10. Prizes, surveys, couponsHook: “You’ve won a phone!” / “Complete a survey for a gift.” Goal: Enroll you in a premium-rate subscription or steal your data. How it works: Fun quiz → “verification” with your number/card → recurring charges. What to do: Skip prize texts. If you clicked, check your mobile bill, Apple subscriptions and cancel new services.

11. Callback smishing → vishing (voice scam)Hook: “There’s a problem with your bank account. Call us now.” Goal: Trick you into calling a scammer pretending to be your bank. How it works: Realistic phone scripts convince you to “verify” your card details or install remote control apps. What to do: Never call back a number from an SMS. Use the number on your card, inside the official app, or on the company’s website.

12. The support link to WhatsAppHook: “Chat with our agent on WhatsApp to verify your identity.” Goal: Move off SMS (harder to monitor) and harvest IDs, selfies, payments. How it works: Deep-link opens a chat with a fake “agent” who requests documents/fees. What to do: Never follow links from SMS to chat apps unless you initiated the conversation.

13. SIM-swap scamsHook: “Your number will be deactivated– update your info.” Goal: Gather enough info to steal your phone number and access your accounts. How it works: Scammers collect info to impersonate you with your mobile carrier. What to do: Contact your phone company directly and ask about SIM-swap protection.

14. Family/friend impersonation (“Hi Mom/Dad, new number”)Hook: “Dad save this new number” / “Hi Mom, I broke my phone– message me here.” Goal: Pull you into a quick “emergency” payment or move you to WhatsApp. How it works: Emotional pressure + urgency; requests instant transfers or vouchers. What to do: Don’t reply. Call the real number you already have for that person to verify.]

15. Messaging-app takeover (“I sent you a code by mistake”)Hook: “I accidentally sent my login code to your number, can you share it back?” Goal: Steal your WhatsApp/other messenger account by grabbing the login code. How it works: If you share the code, they register your account on their device and lock you out. What to do: Never share codes. Turn on in-app two-step verification (a separate PIN).

16. “Recovery” and refund-rescue scams (meta-scam)Hook: “Scammed? &lt;Name&gt; offers trusted recovery support. wa.me/&lt;number&gt;” Goal: Target people who were already scammed and charge “recovery fees.” How it works: Promise to get your money back; ask for upfront payment or more personal data. What to do: Avoid anyone who cold contacts you offering recovery. Report to your bank/police instead.

<h3>Tips &amp; Tricks</h3>There are a number of red flags to watch out for in and SMS. The top signs include:<ul><li>Urgency + consequence: language like “today,” “final notice,” “account lock” drive people to panic and act before they think</li><li>Unexpected links:&nbsp; shortened or unfamiliar domains should always be treated as suspicious</li><li>Code requests: messages like “send back the 6-digit code”</li><li>Channel switch: requests to “Message us on WhatsApp” or “Call this number now” can show intention of planning untraceable, malicious behaviors</li><li>Weird wording/characters: awkward phrasing, unusual spelling or look-alike characters in brand names should always cause pause</li><li>Payment pressure: vouchers, crypto, or wire transfers should be managed carefully over SMS</li></ul>What to do if you receive a suspicious SMS<ol><li>Don’t ever click links and don’t reply. Instead, go to the official website to get information, official phone numbers and emails.</li><li>Do not call any number shown in the SMS. Use the&nbsp;official app, the number on your&nbsp;card, or the company’s&nbsp;website.</li><li>Report it to your mobile provider (many regions use&nbsp;7726/“SPAM”) and to your national reporting channel.</li><li>If you entered details: change passwords immediately; enable 2FA with an&nbsp;authenticator app; watch bank/credit statements and contact your bank if payment info was entered.</li><li>If you installed an app (Android): airplane mode → uninstall → run a trusted mobile security scan; if banking details were involved, contact your bank and consider a full reset as a last resort.</li></ol><h3>Final thoughts: tiny texts, big threats</h3>Scam messages may look harmless (just a few words, maybe a link), but they can be the start of a serious attack. The good news? If you know what to watch for, most of them are easy to spot and avoid.Stay skeptical. Stay informed. And remember: no real service will ever ask for your password or code over SMS.

Scam text messages may be small, but their impact can be huge.

SMS threats: the many faces of a tiny text

<h2 class="text-align-justify">Foreword&nbsp;</h2>The third quarter of 2025 confirmed what many of us have felt all year: the center of gravity in cybercrime is people. Criminals are not only trying to break into devices. They are working to walk users into traps that look and feel legitimate, at scale and with speed. Generative AI has lowered the cost of persuasion and raised the polish of deception. The result is a threat landscape where a convincing message, a nicely branded web page, or a friendly voice can be as dangerous as a zero-day exploit.&nbsp;The patterns we highlighted earlier this year have become more pronounced. “Scam-Yourself” techniques continue to spread across everyday channels like SMS, email, and social media. Phishing moved further from crude copies to what we call VibeScams, where the trick is less in the code and more in the feeling a site gives you at first glance. Attackers are also blending formats. A text message can point to a look-alike login, which then routes a victim to a live chat or voice follow-up. The route is simple. The coordination behind it is criminal.&nbsp;Defenders are adapting too. Our Gen Threat Labs work on both sides of the problem: understanding the criminal playbook and delivering protection that helps real people in real time. On any given week, that can mean reverse engineering a ransomware family to help victims recover their files without paying, training models to spot hidden scam patterns inside inboxes, or publishing practical guidance that families can act on in minutes. We believe research must translate into impact.&nbsp;What you will find in this report reflects that approach. Our Feature Stories highlight real-world examples of what we see, the first of which examines VibeScams, the rise of AI-built phishing factories, and why “looking right” for two seconds is now enough to steal money or credentials. The second story zooms in on SMS – text messages remain one of the most universal and most exploited channels, and this quarter brought fresh tactics that pair automation with human-style tone and timing. The third story covers a new decryptor release and what it revealed about attacker tradecraft, economics, and mistakes. It is a reminder that ransomware is not only about prevention. It is also about giving victims a way back when the worst has already happened.&nbsp;Beyond the Feature Stories, the Threat Landscape connects the dots from first touch to final loss. A sponsored link leads to a look-alike page, an SMS nudges the next click, and an inbox “verification” finishes the job. We document these handoffs with telemetry and case studies, highlight malvertising as a frequent starting point, and show the growing link between social browsing and off-platform fraud. Where numbers can be confusing, we add short notes on definitions and scope.&nbsp;We also track social-to-commerce abuse, where “shop now” and creator tagging push users to off-platform checkout traps; the growing role of AI in the loop, with voice clones and live-chat assistants paired with SMS or email to close the scam; and shifts in payment rails toward instant transfers and refund bait that compress the recovery window.&nbsp;Thank you to everyone who contributed, and to every reader using this report to protect families and teams. Criminals trade on trust. We work to deny that trade, click by click.&nbsp;Read on, stay skeptical, and keep the advantage.&nbsp;Luis Corrons, Security Evangelist (aka Threat Whisperer)

<h2>Threat Landscape Highlights: Q3/2025&nbsp;</h2>In Q3 2025, cybersecurity threats continued to evolve across mobile and desktop platforms, with mobile scams and adware dominating the landscape. Mobile users were particularly targeted by <a href="https://www.gendigital.com/blog/insights/research/ai-generated-personas-deepfake-tactics-scam-yourself-attacks" target="_blank" rel="noreferrer noopener">Scam-Yourself Attacks</a> and HiddenAds adware disguised as fake apps, often distributed through official stores. On desktops, Remote Access Trojans like Wincir remained active, while sextortion, gambling scams, and TechScam campaigns persisted in various regions.&nbsp;&nbsp;Beyond device-level threats, data breaches rose in frequency, with financial data remaining an important concern, led by payday loan misuse, suspicious bank activity, and emerging web skimming and invoice scams.&nbsp;<h3 class="text-align-justify">Security Threats &amp; Scams&nbsp;</h3>Q3 highlighted how closely security threats and scams are now intertwined, evolving together across mobile, desktop, and beyond.&nbsp;&nbsp;<a href="https://us.norton.com/blog/malware/adware" target="_blank" rel="noreferrer noopener">Adware</a> shifted from desktop to mobile this quarter. After last quarter’s desktop spike and the return of <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=The%20return%20of%20DealPly%3A%20Adware%E2%80%99s%20unexpected%20revival&amp;text=The%20return%20of%20DealPly%3A%20Adware%E2%80%99s%20unexpected%20revival" target="_blank" rel="noreferrer noopener">Dealply</a>, we saw a clear increase on Android. The number of blocked adware attacks rose by 77% quarter over quarter on mobile, driven mainly by HiddenAds-style apps that use obfuscation and hide after install, often posing as simple games. A notable share came through the official Google Play Store, which helps explain the growth, since people trust the store and many devices still run without active protection.&nbsp;

On desktop, Remote Access Trojans (RATs) remained persistent with a 10.67% Q/Q increase in risk ratio. The <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=Remote%20access%20exploited%20by%20threat%20actors" target="_blank" rel="noreferrer noopener">Wincir-driven</a> rise from last quarter continued after a mid-year lull, and we saw noticeable RAT spikes in regions like Chile (+77.89%), Spain (+43.87%) and Brazil (+40.75%).&nbsp;&nbsp;Some attacks now travel through trusted update channels. In August, criminals briefly slipped a bad update into a popular developer tool (Nx) that tried to copy passwords and other secrets from the computer. The takeaway is simple. Even software from familiar places can be harmful if a bad update runs. Basics still help: keep automatic updates on, install fewer add-ons, stick to well-known publishers, and if something looks odd, change your passwords and sign out of connected apps.&nbsp;These risks are not abstract; they spill into daily life when critical systems go down. We are more dependent on connected systems than ever, which makes outages and attacks felt in the real world. Two Q3 examples show this clearly. Jaguar Land Rover’s UK plants paused production for more than three weeks after a cyberattack, with officials now assessing the wider supply chain fallout. And on September 20, a cyberattack on Collins Aerospace’s MUSE check-in and boarding software disrupted operations at major European airports including Heathrow, Brussels, Berlin, and Dublin, forcing manual check-ins and causing delays and cancellations.&nbsp;Scam-Yourself Attacks, a new type of threat trend we have tracked in previous quarters on web and desktop, clearly extended to mobile in Q3. On Android and iOS we observed a rise in Fake Scans, a type of Scam-Yourself Attack that imitates system warnings, claiming malware was found and steering users to click malicious links. Today’s mobile threats remain mostly scam-driven rather than exploit-driven.&nbsp;Sextortion activity clustered in August, reaching levels similar to previous peaks. Gambling scams also flared briefly, luring users to place bets then refusing payouts, often using URLs with words like “luck” to lure victims. TechScam continued climbing, with notable spikes in Mexico (1,650%), Chile (1,326%), Czech Republic (974%) and Colombia (700%), typically fronted by fake prompts asking for one-time PINs to “restore” access to messaging or social media.&nbsp;Scams are everywhere, and they move across borders as easily as a text message or email. Law enforcement and security companies are pushing back to stop or at least minimize the impact. A good example is an INTERPOL-coordinated sweep this summer called <a href="https://www.interpol.int/en/News-and-Events/News/2025/African-authorities-dismantle-massive-cybercrime-and-fraud-networks-recover-millions" target="_blank" rel="noreferrer noopener">Operation Serengeti 2.0</a>. Running from June to August across 18 African countries with support from the UK, it led to 1,209 arrests, disrupted nearly 88,000 victimizations, recovered 97.4 million USD, and dismantled 11,432 malicious infrastructures used for scams and cybercrime.&nbsp;The Operation Serengeti 2.0 cases ranged from day-to-day fraud to large networks. In Zambia, authorities broke up a crypto investment scheme tied to 65,000 victims and an estimated 300 million USD in losses. In Angola, police shut 25 illicit crypto mining centers and seized 45 illegal power stations. In Côte d’Ivoire, investigators took down a transnational inheritance scam with losses around 1.6 million USD. INTERPOL says the operation worked because police shared indicators like suspicious IPs, domains, and command servers ahead of time, with private-sector partners contributing threat intelligence and training. Results like these show that coordinated action can claw back funds, take down infrastructure, and make the next wave of scams a little less effective.&nbsp;&nbsp;Coordinated action cannot stop every scam, but it raises costs and removes infrastructure that would otherwise keep hitting consumers.&nbsp;&nbsp;<h3 class="text-align-justify">AI-Driven Attacks &amp; Defenses&nbsp;</h3>In Q3, the AI layer moved from the novelty and research sphere to being a serious part of the real attack surface. Three trends stood out: attackers manipulating AI assistants, targeting add-ons and extensions that power AI tools, and experimenting with ways to embed AI directly into attacks. These trends have been building all year, helping explain why scams now feel faster and more convincing.&nbsp;

The most visible pressure point was assistant and agent abuse. Researchers demonstrated ways to nudge or quietly redirect popular enterprise assistants into revealing information or taking unintended actions. The lesson is simple. If an assistant can access your files or calendar, it deserves the same level of care as any powerful app, with strict permissions and a healthy habit of saying no to unexpected prompts.&nbsp;We also saw supply-chain risk emerge inside AI tooling. In July, the Amazon Q Developer extension for Visual Studio Code briefly shipped with malicious commands after an attacker tampered with the code path. Amazon fixed the issue quickly, but the incident showed that even trusted AI extensions can become a delivery route for harmful actions through normal updates. Extensions and plugins should be treated like apps: keep them updated, choose verified publishers, and remove what you do not use.&nbsp;In an example of how AI is shifting traditional threats, our previous Threat Report covered <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q2-2025#:~:text=and%20ultimately%2C%20dismantled.-,Beating%20FunkSec%3A%20When%20ransomware%20meets%20AI,-It%20started%20like" target="_blank" rel="noreferrer noopener">FunkSec</a>, the first ransomware where criminals used AI to help them write ransomware code. This quarter, researchers reported a proof-of-concept (not real malware found in the wild) called PromptLock, that goes one step further. Instead of using AI during development, it uses a small model on the device during the attack to generate commands in real time. This makes the behavior more flexible and, in theory, harder for older, static detection methods to catch. Even as a demo, it points to how ransomware might evolve due to AI.&nbsp;Persuasion research also stood out this quarter. Simple framing cues like authority and urgency made chatbots more likely to answer questions they should refuse. That same psychology fuels today’s “vibe-correct” phishing, where fake pages look and feel legitimate at first glance. AI helps criminals scale the look, the language, and the timing, which is why our VibeScams featured story is so timely.&nbsp;We are also seeing state actors adopt the same playbook. In mid-July, security researchers reported a Kimsuky campaign that used ChatGPT to generate realistic images of South Korean military ID cards to make spear-phishing emails look official; the link delivered malware, not an ID. The same report ties the activity to earlier <a href="https://www.gendigital.com/blog/insights/research/deceptive-nvidia-attack" target="_blank" rel="noreferrer noopener">ClickFix</a>-style lures and shows how AI is used to polish the “front end” of an attack. Separately, Anthropic <a href="https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf" target="_blank" rel="noreferrer noopener">documented</a> North Korean operators using Claude to fabricate identities and pass coding tests for remote jobs. Together, these cases show AI as a force multiplier for social engineering, not just code writing.&nbsp;&nbsp;The same AI boost shows up in text messages. Our SMS Threats featured story explains how AI tools now draft and localize smishing messages that match brand tone, include believable details, and land at the right hour. This is why delivery notices, bank alerts, and account lock texts feel more urgent and legitimate than they used to.&nbsp;As mentioned previously, <a href="https://lifelock.norton.com/learn/internet-security/ai-scams" target="_blank" rel="noreferrer noopener">AI-enabled scams</a> are now a real part of the threat landscape. Similarly, we are starting to see the early trends of video scams and deepfakes in our Gen telemetry. Q3 is our first quarter with telemetry from Media Shield, our new on-device deepfake protection for Windows AI PCs. The feature is still in early rollout with a limited installed base, so these results are indicative rather than market-wide. Even so, some patterns stand out. Most detections were flagged as deepfake audio, with a smaller share of scam videos. Within those scams, cryptocurrency and financial lures dominated, while the rest were more generic fraud attempts. Importantly, almost all of the scam clips were low-reach, with very few above 10,000 views, suggesting that deepfake scams are more common in niche content than in widely viral videos.&nbsp;These are early indicators, not population-wide trends, but they show how manipulated media is being used today: less about chasing virality, more about convincing smaller audiences to part with money.&nbsp;The picture that emerges is clear. Attackers are getting results through orchestration and persuasion, not only through clever code. Defenders are moving from written rules to built-in protections that act while you use the product: clearer guardrails in the chat, safer default settings, and tighter limits on what assistant tools can access. For consumers, the practical takeaway is to be extra careful with anything that asks an assistant to reach into your files, messages, or finances, to limit what plugins can do, and to treat perfect-looking pages with healthy doubt, especially when they ask for passwords or payments.&nbsp;<h3 class="text-align-justify">Privacy&nbsp;</h3>When you use digital products, you leave a trail. Sites and apps collect details about your device, browser, and how you move around a page. Combined, these signals form a “digital fingerprint” that can identify a person across different sites and sessions. Fingerprinting is widely used on the web and can track people even without cookies, which is why it matters for consumers who think clearing cookies is enough.&nbsp;

Our telemetry shows that since July 2025 we have blocked an average of 247 million trackers per month, and we are seeing almost 37 million digital fingerprints per month, a 1% quarter-over-quarter increase. This tells us that tracking is alive and growing. Fingerprinting keeps you identifiable even without cookies, letting companies and data brokers stitch together a detailed record of what you read, buy, and search. That profile can shape the prices you see, fuel relentless targeting, and give scammers enough detail to make fake messages feel real.&nbsp;While digital fingerprints allow your every move to be tracked online, encryption keeps everyday chats, photos, and backups private – and it can also frustrate criminal investigations. Some policymakers argue for special access for law enforcement, while security and privacy experts warn that any built-in workaround weakens protection for everyone. This quarter, in the UK, encryption policy reminded everyone that this is not a settled debate. In February, Apple removed its Advanced Data Protection option for iCloud in the UK after receiving a secret legal order under the Investigatory Powers Act and took the matter to the Investigatory Powers Tribunal. In August, the tide appeared to turn when the U.S. Director of National Intelligence said the UK had agreed to drop the backdoor demand. For consumers, the signal is simple: strong encryption still has heavyweight defenders, but it remains a live policy fight. &nbsp;Across the EU, governments are still arguing over the proposal nicknamed “Chat Control,” which would let authorities issue detection orders that require services to scan for child-abuse material and grooming. Parliament’s position rejects generalized scanning and seeks to protect end-to-end encryption, while the Council remains split, with several countries including Germany opposing client-side scanning and others backing it ahead of scheduled votes. The upshot is that messaging privacy rules are still being decided, and outcomes could vary by country in the months ahead.&nbsp;&nbsp;Another privacy reminder came to us this quarter from Sam Altman, OpenAI’s CEO. He has warned that therapy-style chats with ChatGPT are not protected like conversations with a doctor or lawyer, and that transcripts could be requested in a lawsuit. Treat AI chats like any other online form: if you would not say it in a crowded room, do not paste it into a chatbot, especially anything about health, legal matters, or finances.&nbsp;&nbsp;<h3 class="text-align-justify">Trust and Identity &nbsp;</h3>Digital identity theft is clustering around fast-cash products and routine account probing. Criminals are applying for short-term loans and new cards in victims’ names, then testing access to existing bank accounts.&nbsp;This quarter we saw more instances of breach events but smaller ones. The total number of breach events increased by 76%, while the overall volume of leaked records fell by 81%. In simple terms, there were more incidents, but each affected fewer people. What makes this trend concerning is the type of data exposed. The share of breaches containing passwords rose sharply to over 83%, even as breaches with email addresses declined. That means the “quality” of stolen data improved from a criminal’s perspective, as credentials are far more valuable than contact lists.&nbsp;A breach event represents each separate case where data was exposed, while breached data refers to the total number of individual records leaked. So even if the total number of records goes down, more events mean more unique services and users potentially affected. The combination of smaller, more frequent breaches with richer data shows that attackers are focusing on precision and value rather than scale.&nbsp;

Across financial alerts in Q3, payday loans represent the largest share of unique alerted users at 32%, followed by new credit card applications at 15%, typically fraudulent attempts to open cards in a victim’s name. Protective lock blocks on payday loans accounted for 10%, reflecting successful blocks applied after a fraud attempt. Existing bank-account updates (unauthorized changes) and new auto applications each represent 6%.&nbsp;On the transaction side, alerts are led by suspicious bank-account activity (42%) and credit card activity (20%). Smaller but notable shares include gray charges -small, technically authorized recurring fees like trial rollovers and add-on “clubs”- (9%), unusual charges (8%), and login errors at financial institutions (7%). The pattern reflects a familiar playbook: move fast to turn access into cash, then test the limits of existing accounts.&nbsp;

Alert patterns mirror a broader trend in which third-party access and support systems serve as frequent entry points. This quarter, a wave of attacks exploited company Salesforce ecosystems, often through connected third-party integrations. The FBI issued an advisory on two clusters—UNC6040 and UNC6395—describing tactics such as vishing for support credentials and abusing compromised OAuth tokens from the Salesloft–Drift integration to export customer data. Those exports can include support ticket text containing names, contact details, and even embedded secrets. The result: highly convincing <a href="https://us.norton.com/blog/online-scams/what-is-phishing" target="_blank" rel="noreferrer noopener">phishing</a> that references real cases.&nbsp;Several firms confirmed exposure tied to this activity. Cloudflare reported exfiltration from its Salesforce tenant between August 12 and 17, 2025, limited to support case objects. Trade and tech press covered similar confirmations and mitigation steps across the industry.&nbsp;A number of breaches also impacted well-known, non-tech brands. Air France–KLM said a third-party platform used by its contact centers was compromised in the week of July 28, exposing customer contact and loyalty details. These incidents do not always include passwords or card numbers, but they give scammers exactly what they need to personalize lures and create successful account-reset attacks.&nbsp;Luxury retail provided another example of why “profile” data matters. In mid-September, Kering confirmed a June intrusion that led to theft of customer data for brands including Gucci and Balenciaga. Reports noted contact details and total spend amounts, which can be used to target high-value buyers with bespoke fraud.&nbsp;<h3 class="text-align-justify">Financial Wellness &nbsp;</h3>Criminals are shifting financial theft to where payments actually happen: online checkout pages and accounts payable. We saw two key patterns emerge in financial theft in Q3: more attempts to skim card data directly from merchant payment pages and a rebound in fake or altered invoices that reroute money during vendor payments.&nbsp;On desktop, web skimming attempts increased quarter over quarter. These are attacks that inject code into a store’s checkout page to capture card numbers and billing details as you type. We also saw invoice-scam activity rise again after a summer dip, with renewed waves targeting people who handle bills and supplier payments.&nbsp;&nbsp;

Independent threat reporting <a href="https://www.recordedfuture.com/research/h1-2025-malware-and-vulnerability-trends" target="_blank" rel="noreferrer noopener">says</a> web skimming levels remained high through 2025, with thousands of ecommerce sites affected in H1 and beyond. One July campaign hit OpenCart shops by hiding skimmers among analytics tags like Google Tag Manager and Meta Pixel. Researchers also described variants that validate cards via a legacy Stripe API and even move skimming into malicious browser extensions. When looking at these trends together, it is clear that client-side checkout is a hot target.&nbsp;Payment industry standards have reacted. PCI DSS 4 emphasizes script authorization and change detection for checkout pages, reflecting how much risk now sits in third-party and client-side code. For consumers, the implication is simple: a site can look trustworthy and still be compromised on the page where you pay.&nbsp;Invoice scams also increased in Q3 after a short summer lull, with attackers impersonating trusted vendors and official bodies to reroute payments. This echoes wider signals from regulators and law enforcement, including a Europol–EUIPO report in May that flagged a significant rise in fraudulent invoices across the EU, often boosted by email spoofing and lookalike domains, and the FBI’s latest IC3 report noting record losses with business email compromise still driving invoice diversion and vendor payment fraud.&nbsp;

Patrik Holop, Principal Data Scientist&nbsp; Luis Corrons, Security Evangelist&nbsp; Peter Kováč, Lead Data Scientist&nbsp; Jakub Vávra, Sr Threat Analysis Engineer&nbsp;<h2 class="text-align-justify">Featured Stories: Consumers Under Siege&nbsp;</h2>Cyber threats don’t usually announce themselves with flashing warnings or complex exploits. Increasingly, they arrive in the everyday moments of people’s lives: a website that “feels” right, a text that buzzes during morning coffee, a file that suddenly locks on your desktop. What unites these attacks isn’t just the technology behind them, but the way they prey on routine, trust, and timing.&nbsp;This quarter’s featured stories spotlight three very different fronts of this same battle. Our story on VibeScams shows how AI-powered web builders are turning phishing into a plug-and-play service, where the danger isn’t a sloppy code but a flawless “vibe.” The SMS Threats feature reveals how the tiniest of texts can funnel victims into large-scale fraud, evolving into one of the most persistent and underestimated attack vectors. And our report on Midnight Ransomware reminds us that even hardened cyber extortion can falter: when copy-paste criminals forget the math, defenders can seize the opportunity to turn the tables.&nbsp;Together, these stories capture the reality of consumers under siege: threats are faster, more deceptive, and closer to daily life than ever before, but also more fragile when exposed to the right defenses.&nbsp;<h3 class="text-align-justify">VibeScams - Phishing factories powered by AI&nbsp;</h3><h4 class="text-align-justify">A new kind of phishing&nbsp;</h4>We call them VibeScams because the trick isn’t in the code, it’s in the feeling. These sites pass the “vibe check”: the colors, the spacing, the logo placement, even the tiny footer links nobody reads but everybody recognizes. They feel right at first glance, and that’s enough to fool people into handing over money or credentials.&nbsp;What makes VibeScams different is that the criminals behind them often aren’t technical experts. Just like VibeCoding lets anyone create software without coding, these platforms let anyone create scams without phishing know-how or web-design skills. A few words typed into an AI-powered builder are enough to generate a polished, brand-like page that can be abused straight away.&nbsp;You open a text that says your DHL or FedEx parcel needs a small fee for delivery. You need your package, so you quickly click the link. The page you see passes a brand audit: the yellow (or purple, depending on brand), the spacing. Tomorrow it’s a Coinbase “wallet verification” or a Microsoft login. Everything looks great, right up until your money’s gone.&nbsp;Thanks to AI, the phishing supply chain has completely upleveled. AI web-builders have turned “make me a page that feels like X” into a one-line prompt. Some even spin up a site from a screenshot. No HTML, no design school, no expensive dev hours—just a credible, on-brand clone in minutes. That shift drops the barrier to entry for scammers and multiplies the risk for everyone else.&nbsp;

<h4 class="text-align-justify">Why this works&nbsp;</h4>Our researchers stress-tested this ourselves. Using free offerings, we asked a handful of popular website builders to help us recreate the vibe of TikTok, Microsoft, Instagram, Coinbase, and Binance. The results were alarmingly realistic: polished layouts, familiar components, auto-generated copy that felt “official enough,” and one-click publishing. In other words: plug-and-play phishing.&nbsp;And it’s not a fringe phenomenon. We’re seeing a surge of AI-built fakes across well-known platforms: think delivery brands, mobile carriers, crypto wallets, insurers, social media apps. Many are near-indistinguishable at a glance, especially on mobile where the URL bar is tiny and the design does most of the convincing. Since January 2025, we have blocked approximately 140,000 different AI-generated websites, roughly 580 new malicious sites every day on average. In the same period, we protected nearly 190,000 of our users, with the U.S., France, Brazil, and Germany among the most affected. That’s a lot of “almost-right” pages catching people on a busy Tuesday.&nbsp;

<h4 class="text-align-justify">Behind the curtain&nbsp;</h4>Why is this working so well on otherwise careful people? Because the old red flags (typos, clunky layouts, weird spacing) don’t show up when the page is composed by an AI design assistant. The scam succeeds on vibe: the color, the logo, the tone of the microcopy, the way the “Continue” button sits exactly where your thumb expects it. Localization is trivial now, too. If a campaign targets Spanish speakers in Madrid today and German speakers in Munich tomorrow, the builder simply re-spins the template with new text. And because set-up is cheap or free, criminals can A/B test headlines, icons, and prompts like growth teams do, then keep only what converts.&nbsp;

Under the hood, the workflow is painfully simple. Step one: prompt the builder to generate a page that looks and feels like a trusted brand or upload a screenshot for it to mimic. Step two: “wire up” the forms, either with built-in tools or by exporting the template and asking another AI to handle submission and exfiltration. Step three: publish, measure, iterate, repeat. When a host removes one site, a fresh copy appears somewhere else in minutes. It’s phishing as a service, and the inventory never runs out.&nbsp;To understand what criminals were actually using these AI-generated sites for, we went beyond blocking the URLs. Our team examined the detected domains and analyzed the structure and behavior of the pages. That included looking at the forms they contained, the data they attempted to capture, and the redirection flows that followed. In some cases, the purpose was obvious: credential fields cloned from bank or email logins. In others, links led to cryptocurrency “investment” portals, payment card skimming forms, or remote-support software downloads. And in the future, attackers could just as easily deploy fake crypto “verification” pages that drain seed phrases. By classifying each site this way, we built the threat type breakdown shown in the chart, with phishing dominating, crypto scams close behind, and a smaller slice made up of tech-support and other fraud attempts.&nbsp;

Real-world outcomes follow predictable patterns. Credential-harvesting logins feed account takeovers. Crypto-themed scams try to funnel victims into fake investments. Delivery-fee pages skim cards for small “tests” before bigger hits. Tech-support look-alikes push remote-control installs. The specifics differ, but the mechanics are the same: a believable façade buys a few seconds of trust, just long enough to steal something valuable.&nbsp;<h4 class="text-align-justify">Turning the tables&nbsp;</h4>Here’s the good news: this is not a losing game. On our side, we’re blocking the funnel. We detect and stop known-bad builder subdomains and typosquats before the page loads, so the “vibe” never gets a chance to trick you.&nbsp;&nbsp;Some builders are stepping up, too. When we flagged abusive sites, providers like Lovable, Elementor, Flazio, Softr, Webflow, and WebWave moved quickly to remove them. It shows that responsible reporting works, and that user vigilance plays a role as well. The faster suspicious sites are reported, the faster they’re taken down. Still, the ease of spinning up new clones means takedowns alone can’t win the race; prevention and protection remain critical.&nbsp;That’s why we also track bursts of brand impersonation across multiple builders and work directly with providers to limit abuse. And in our consumer products, features like Scam Protection and Scam Guardian help people sanity-check links and pages in the moment they need it most.&nbsp;What should readers do differently? Start by distrusting design. If a page “feels” right but the request is unusual—seed phrases, 2FA codes, urgent refunds—treat that mismatch as a siren. Don’t follow login links from texts or DMs; use your own bookmark or the official app. For deliveries, jump to the known URL yourself rather than tapping through. And keep unique passwords with MFA turned on, so one mistake doesn’t unlock everything.&nbsp;<h4 class="text-align-justify">The bottom line&nbsp;</h4>VibeScams don’t mean the web is broken. They mean phishing has matured. Speed, scale, and accessibility are now the attacker’s edge; precision, verification, and layered protection must be ours.&nbsp;&nbsp;Phishing no longer requires phishers, just a prompt. If design can be faked in seconds, then trust has to live somewhere harder to fake—like the URL you typed yourself, the security tools that block bad pages on the way in, and the habit of pausing when something feels a little too perfect.&nbsp;Want to dig deeper? Our full blog post on <a href="https://www.gendigital.com/blog/insights/research/vibe-scams" target="_blank" rel="noreferrer noopener">VibeScams</a> explores detailed case studies, examples of AI-built sites we uncovered, and how criminals are adapting their tactics.&nbsp;<h3 class="text-align-justify">SMS threats: the tiny texts criminals love&nbsp;</h3>A buzz at 8:12 a.m.&nbsp; The message lands while you’re making coffee:&nbsp; “Your account was accessed from a new device. If this wasn’t you, call us now: &lt;Phone Number&gt;”&nbsp;It even appears inside the same branded thread your bank uses. In under a minute you could be talking to a convincing “agent”, handing over one-time codes; because, who ignores a security warning?&nbsp;That’s the power of SMS as an attack vector: it’s cheap, instant and feels personal. And while headlines chase flashier threats, text-initiated fraud keeps quietly scaling. In 2024 alone, people reported <a href="https://www.ftc.gov/news-events/news/press-releases/2025/04/new-ftc-data-show-top-text-message-scams-2024-overall-losses-text-scams-hit-470-million" target="_blank" rel="noreferrer noopener">$470 million in losses</a> that began with a text, 5 times the amount reported in 2020. The U.S. regulator’s summary is blunt: texting is “cheap and easy,” and scammers know the ding is hard to ignore.&nbsp;&nbsp;Carriers and industry monitors don’t expect relief soon. Research with global operators finds over half anticipate more SMS fraud this year, not less, as criminals exploit pricing shifts, routing weaknesses and artificially-inflated traffic. Meanwhile, awareness lags. <a href="https://www.ofcom.org.uk/siteassets/resources/documents/research-and-data/telecoms-research/scams-research/experiences-of-suspicious-calls-texts-and-app-messages-research-2024.pdf?v=373453" target="_blank" rel="noreferrer noopener">In the UK</a>, just 15% of mobile users even know about the free 7726 number to report scam texts; only 6% have used it, meaning networks miss signals that would help them filter faster. And as law enforcement has warned, waves like toll/parking smishing can hop state-to-state in weeks, keeping victims and defenders off-balance.&nbsp;<h4 class="text-align-justify">This quarter’s SMS hall of shame&nbsp;</h4>This quarter we went through millions of malicious SMS hitting users around the globe. Below are the five most widespread campaigns we tracked. Each item refers to one concrete campaign, and the example shown comes from that campaign. The percentages are the share of all scam SMS attributed to that exact campaign in our telemetry during the period. This is not a ranking of scam types overall. Together, these five campaigns account for 26% of all malicious SMS seen this quarter:&nbsp;<ol><li data-list-item-id="e7acfb3896e8427c9fbde38c9cc45b496">Employment Scam (8% of all scam SMS)&nbsp;&nbsp;</li><li data-list-item-id="e31348b043602c4057e08189954bd876b">Fake Refund (7%)</li><li data-list-item-id="e8fda1dc91806f96ba98babdfe5ccc10f">Tax Refund / Fine (6%)</li><li data-list-item-id="ee1bc9064b1f2b102357763fa1c049510">Investment (3%)</li><li data-list-item-id="e5e3b5458317db28ec0742223a1ef5e5c">Delivery (3%)&nbsp;</li></ol>

<h4 class="text-align-justify">How the tiny text does outsized damage&nbsp;</h4>The trick isn’t high-end malware. It’s friction—or rather, the lack of it. SMS lives where real life does: delivery updates, two-factor codes, appointment reminders. Scammers hide in that noise and win the first five seconds: a short link, a short deadline, and a decision before coffee kicks in. Industry surveys suggest four in ten smartphone users encountered smishing attempts in 2023, a reminder that the top of the funnel is broad, even before under-reporting narrows official stats.&nbsp;Two dynamics keep SMS underrated and under-discussed. First, it’s cross-channel by design. Many campaigns quickly push you off SMS (onto a callback number or a messaging app) where pressure works better and defenses are weaker. Mobile operators/carriers can filter texts at the network level, and in some markets, regulators require them to do so; they can’t police your phone call in real time. Second, the signals are subtle. Phones can group messages by sender name, so a fake bank alert may land inside your real bank thread. Add a shortened URL and a convincing domain, and most of us are one tap from trouble.&nbsp;<h4 class="text-align-justify">The tricks behind the texts&nbsp;</h4><a href="https://us.norton.com/blog/emerging-threats/smishing" target="_blank" rel="noreferrer noopener">Smishing</a> doesn’t win because attackers out-engineer the phone. It wins because the channel feels routine and the disguises are simple but effective. Most texts arrive in the same inbox as your delivery updates and one-time codes; criminals hide in that noise and ask for something small before your brain has switched from “admin mode” to “security mode.” The playbook is a blend of human psychology (urgency, authority, convenience) and tiny technical tricks that make a dangerous message look ordinary for the three seconds it takes to tap.&nbsp;Under the hood there’s no magic, just throwaway domains, and tricks that defeat quick visual checks and basic filters. When a lure needs more time or pressure, the conversation jumps channels—to a phone call or a WhatsApp chat—where defenses are weaker and a calm “agent” can walk a victim through the rest. And if someone hesitates or realizes too late, a second wave appears offering “recovery services” that charge a fee to “get your money back.”&nbsp;Here are the mechanics doing most of the damage right now, and how they slip past both filters and busy humans:&nbsp;<ul><li data-list-item-id="ee43550981747fc9d4e9b42a09a58d485">URL masking: public shorteners (e.g., cutt.ly, tinyurl.com, rb.gy) and throwaway domains hide destinations long enough to win a tap.</li><li data-list-item-id="e54b9740582507d5512f801b4078d08fa">Brand-ish web addresses: subdomains that glance official at speed, like flhsmv.govturim[.]vip exploit our habit of only reading the start of a URL.</li><li data-list-item-id="e1e8f0554e6cbc656c7c56dcbab61f260">Username-in-URL phishing: https://www.fedex.com@… still misleads in SMS because the real hostname is everything after the @.</li><li data-list-item-id="eb4940436564e3927f17569e0e5202dcb">Unicode obfuscation: SMS supports UTF-16, so look-alike characters turn Amazon into Αmаzon; filters and humans both slip.</li><li data-list-item-id="ee6105c45f8c93df2ee73bd676cd848e7">Pivots to voice/messengers: moving victims to WhatsApp/Telegram or a phone call segments the attack across platforms: harder to detect, easier to pressure. Public warnings around toll/parking smishing illustrate how fast these waves evolve.</li><li data-list-item-id="e9a8b97965f6d1aaefda18bd69ee31418">The “rescue” after the scam: recovery-service pitches (“Scammed? We can help—chat here”) target people already hurt, extracting a second fee.&nbsp;</li></ul>For readers who want to see these categories in more detail, our blog post “SMS threats: the many faces of a tiny text” expands this list with screenshots, examples, and step-by-step advice.&nbsp;<h4 class="text-align-justify">When AI enters the picture&nbsp;</h4>Artificial intelligence is quietly reshaping this landscape. Where criminals once leaned on clumsy, typo-filled texts, they can now generate fluent, localized messages at scale, each one tailored to the language and phrasing of its target country. AI can also spin up endless variations, making filters that rely on spotting repeated patterns far less effective.&nbsp;And it’s not just text. Attackers are beginning to pair SMS with AI-generated voice calls or chatbot follow-ups on WhatsApp, creating a seamless multi-channel fraud that feels eerily professional. The result: scams that used to raise suspicion now read like the messages you really do get from banks, couriers, or tax offices. For defenders, this means the bar keeps rising; for consumers, it means skepticism has to become second nature.&nbsp;SMS may not trend like ransomware or zero-day headlines, but its quiet efficiency is exactly the point. It reaches everyone, blends with daily admin, and routes victims into higher-value fraud with almost no friction. Until awareness (and reporting) catches up, the smallest message on your phone will keep doing outsized damage—one buzz at a time.&nbsp;<h3 class="text-align-justify">Cracking Midnight: when copy-paste ransomware forgets the math&nbsp;</h3><a href="https://www.avast.com/c-what-is-ransomware" target="_blank" rel="noreferrer noopener">Ransomware</a> has long been treated as unbeatable: files are locked, the math is unbreakable, and victims are forced into a terrible choice: pay or lose their data. Midnight ransomware tells a different story.&nbsp;Built on Babuk’s leaked source code, Midnight is part of a new wave of copy-paste ransomware projects. But instead of improving on the original, its authors weakened it. In analyzing the code, our researchers uncovered a critical weakness in Midnight’s cryptography, the kind of mistake that is rarely seen in modern ransomware. By identifying and leveraging this flaw, the team was able to develop a free decryptor that gives victims a way out without paying.&nbsp;<h4 class="text-align-justify">Midnight in the wild&nbsp;</h4>At first glance, Midnight doesn’t look much different from other ransomware. It locks files, drops a ransom note called How To Restore Your Files.txt, and demands payment. In most cases, victims see their files renamed with the .Midnight or .endpoint extension, a tell-tale sign of the infection.&nbsp;

Earlier versions of Midnight mainly went after high-value data such as databases and backups, but more recent ones broadened the scope to nearly all common file types, leaving only program files untouched. To move quickly, it also uses a trick called intermittent encryption, touching just enough of a file to make it useless while speeding through the system.&nbsp;On the surface, all of this looks like business as usual for ransomware. But underneath, Midnight’s authors made critical mistakes in the encryption design, mistakes that turned into opportunities for defenders.&nbsp;<h4 class="text-align-justify">From Babuk to broken forks&nbsp;</h4>The 2021 Babuk leak was a turning point for the ransomware ecosystem. Suddenly, sophisticated source code was available to anyone who wanted to try their hand at cyber extortion. That leak spawned numerous spin-offs, some more successful than others. Midnight is one of these, and its story illustrates an important trend.&nbsp;Rather than giving rise to a new “super strain,” the Babuk leak produced a wave of rushed, amateurish forks. Midnight is a textbook case: criminals re-used the code, made “improvements” they didn’t fully understand, and ended up with a product that sabotaged itself.&nbsp;Our researchers uncovered weaknesses in its cryptographic design, rare flaws that opened the door to building a working decryptor. For defenders, even a single mistake of this kind is valuable; in Midnight’s case, the opportunity was even greater.&nbsp;<h4 class="text-align-justify">A free way out&nbsp;</h4>Armed with these insights, we developed a free Midnight Ransomware Decryptor. Victims can use it to recover files safely without paying ransom.&nbsp;Rather than duplicating technical detail here, we’ve published a full breakdown on our research blog, including indicators of compromise, screenshots, and step-by-step decryptor instructions. This report tells the bigger story.&nbsp;For defenders and researchers who want the technical details, our colleague Samuel Vojtáš has published an analysis of Midnight on the Gen blog. His article walks through the ransomware’s evolution from Babuk, highlights its quirks, and provides step-by-step instructions for using our free decryptor. You can read the deep dive here: <a href="https://www.gendigital.com/blog/insights/research/midnight-ransomware" target="_blank" rel="noreferrer noopener">Decrypted: Midnight Ransomwar</a>e&nbsp;<h4 class="text-align-justify">Why Midnight matters&nbsp;</h4>Midnight may not be the most widespread ransomware of 2025. But its lessons resonate far beyond its victim count:&nbsp;<ul><li data-list-item-id="ef872d2a26c053b8187346144d939a23c">Copy-paste criminals. Leaked source code is fueling countless ransomware spinoffs, but not all of them are stronger. Midnight proves that copy-paste shortcuts can weaken attackers.</li><li data-list-item-id="e6430be1e9ee1f864649e529f5fde79a9">Rare crypto flaws. Finding single exploitable vulnerabilities in ransomware encryption is uncommon, but Midnight proves that criminals don’t always get the math right.</li><li data-list-item-id="edc240bd0f64d4b1902b8b57af4bde758">Hope for victims. Midnight shows that ransomware isn’t always the end of the road. Free decryptors exist, and paying isn’t the only option.</li><li data-list-item-id="ee48e43821ce5d75497f203cb4cd04ac9">AI hype vs. reality. While headlines spotlight AI-assisted ransomware experiments, Midnight shows the other side of the ecosystem — rushed projects built on leaked code, riddled with rookie mistakes. The ransomware landscape is splitting: some groups experiment with AI, while others sabotage themselves. That fragmentation creates new openings for defenders.&nbsp;</li></ul><h4 class="text-align-justify">The bigger picture&nbsp;</h4>The ransomware ecosystem is fragmenting. Instead of a few large, disciplined groups dominating the field, we’re seeing a growing number of buggy forks, rushed experiments, and copycats built on leaked code. That’s good news for defenders: the more mistakes criminals make, the more opportunities we have to neutralize them.&nbsp;Midnight is a case in point, ransomware that tried to build on Babuk’s legacy, but ended up undermining itself. For victims, our decryptor means recovery without ransom. For the industry, it’s a reminder that ransomware isn’t always unbreakable. And for criminals, the message is clear: recycling someone else’s code won’t guarantee success.&nbsp;Branislav Kramár, Threat Analysis Engineer&nbsp; Daniel Beneš, Senior Threat Researcher&nbsp; Jan Rubín, Threat Research Team Lead&nbsp; Ladislav Zezula, Senior Malware Researcher&nbsp; Luis Corrons, Security Evangelist Samuel Vojtáš, Threat Analysis Engineer&nbsp; Tadeáš Zíka, Threat Analyst&nbsp;<h2 class="text-align-justify">In Closing&nbsp;</h2>This quarter confirmed the shift we have tracked all year: cybercrime targets people first. AI has made scams look right and feel right, from VibeScam lookalikes to SMS lures that hand victims to live “support.” Ransomware remains loud, yet the quiet wins come from shrinking the gap between first contact and first protection. Our focus stays on real-time defenses inside the places people already talk and shop, with clear help in the moment of doubt.&nbsp;With the holiday season nearing comes the peak shopping season. Expect scams tied to deliveries, order issues, too-good-to-be-true deals, fake support, and “in-platform” fraud across marketplaces and social. The playbook for readers is simple: slow one beat, check the sender and the URL, never share one-time codes, use 2FA or passkeys, and pay only inside trusted checkouts. We will meet criminals in the conversation with protections that spot the con and stop the loss. See you next quarter with the results.&nbsp;

<h2 id="download-the-q2/2025-threat-report-key-highlights">Download the <a href="https://www.gendigital.com/blog/sites/default/files/2025-11/Q32025%20Threat%20Report%20PDF%20Highlights.pdf" target="_blank" title="Q3/2025 Threat Report Key Highlights">Q3/2025 Threat Report Key Highlights</a></h2>Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

Tracking the surge of mobile scams, AI-driven attacks, and evolving data threats across Q3 2025.

Gen Q3/2025 Threat Report 

<h2>Foreword</h2>Welcome to our latest Gen Threat Report, this time focused on Q2/2025. April through June brought a complex mix of progress and peril across the cyber threat landscape. Some of the positive aspects included a slight decline in the overall threat risk ratio and several law enforcement operations aimed at disrupting cybercrime groups. At the same time, the threat landscape remained active, with a record volume data breaches, disruptive ransomware incidents and a steady stream of inventive scams. Navigating these signals requires careful interpretation, so let's explore the most significant developments together.One of the busy areas this quarter was the continued targeting of personal data. Breach events increased by nearly 21% quarter-over-quarter, and the number of exposed email addresses rose by over 15%. Also, credit alerts remained the most common identity-related notification in our systems. We also continued to see fallout from the X (Twitter) leak, which went public in early April, with compromised records resurfacing in various contexts. Q2 also brought headlines about the takedown of Lumma Stealer, one of the most notorious infostealers in recent years. While parts of its infrastructure were disrupted, the story didn’t end there. Based on our telemetry, Lumma remains alive and kicking,&nbsp;despite the efforts to dismantle this group. Distribution channels continued to operate, and data exfiltration persisted throughout the quarter. As we’ve seen before, bringing down one part of an ecosystem doesn’t always stop the threat entirely. You can read more about Lumma and the aftermath of the takedown in the featured story below. Still, the effort reflects growing coordination between law enforcement and the security community. Other notable actions this quarter included the indictment of Qakbot’s leader, charges against DanaBot operators and Europol’s Operation Endgame targeting ransomware infrastructure.On the financial-threats front, our research of an illegal pharmacy network&nbsp;revealed over 5,000 scam domains connected to a single cybercriminal group. The operation spans continents, hijacks legitimate websites and uses everything from fake blogs to chatbot-generated recommendations to lure victims. The goal is clear: harvest financial and personal data under the guise of discounted medicine. The full story is covered in our featured section on what we’ve dubbed “PharmaFraud”, which offers a closer look at how scalable and targeted this kind of fraud has become.&nbsp;Not all financial stories this quarter ended in loss. After tracking the FunkSec ransomware for several months, our team discovered a flaw in its encryption logic. This was another case of malware partially created using generative AI,&nbsp;and the first instance we’ve known for ransomware operators. According to the group itself, AI was used to assist with tooling, phishing templates and code snippets. Fortunately, it was still possible to identify a cryptographic weakness. Working quietly with law enforcement, we helped victims recover their data and later released a free decryption tool from the Avast brand. FunkSec has since gone quiet. While rare, this case shows that even AI-assisted threats can contain exploitable flaws when examined closely. You’ll find the full breakdown in the FunkSec featured story.Scams, as usual, remained among the most persistent threats, especially on mobile. Technical Support Scams&nbsp;(TSS) rose by nearly 65% globally, spreading increasingly through social media platforms. On Facebook, they accounted for 14% of the threats we blocked. Geographically, activity expanded beyond the usual hotspot of Japan, doubling in countries like Germany, Austria and France. Sextortion scams&nbsp;also surged, showing over a 100% increase in risk ratio, while financial scams affected users across major economies and platforms. Some impersonated legal services; others relied on urgency and fear. The tactics remained familiar, but the delivery kept evolving. Even malvertising found new ways to stay relevant. While overall volumes dipped slightly, malicious push notifications jumped by over 300%. These deceptive browser alerts, once accepted, gave attackers a way to keep targeting users long after the initial visit, often with scam content or fake system warnings designed to trigger panic clicks.In terms of malware threats, remote access threats&nbsp;saw a notable rise. The Wincir Remote Access Trojan (RAT) continued its resurgence, often delivered through so-called “Scam-Yourself” attacks, where users are tricked into launching the malware themselves. We also looked at how threat patterns differ between individuals and small businesses. On desktops, scams and malvertising led across both groups, though small businesses showed slightly lower risk exposure. The methods were familiar; the targets interchangeable. Finally, DealPly adware returned from near-obscurity in late Q2. Reactivated domains and Chrome extension infrastructure led to a fourfold increase in exposure between April and June. It was a timely reminder that even long-dormant threats can quickly regain traction.Overall, Q2/2025 reflected the complexity of today’s threat landscape. Some threats faded, others adapted, and a few returned in force. Scam and malvertising campaigns continued to lead in volume. Ransomware saw both setbacks and reversals, with at least one case offering real hope for victims. Personal data remained a high-value target. And enforcement efforts, while encouraging, didn’t always stop threats from resurfacing.&nbsp;Thank you for reading. We hope the report brings clarity to a quarter shaped by complexity and contradiction.Jakub Křoustek, Threat Research Director&nbsp;<h2>Threat landscape highlights: Q2/2025</h2>Although the most common types of threats tend to remain consistent over time, the threat landscape is in constant flux as malicious actors adapt their tactics to pursue harmful objectives. These changes are influenced by our evolving digital behavior – ranging from changing social media use and online shopping trends to increased remote learning and high-profile data breaches that impact our digital security. With the global risk ratio being 24%, almost one in four users encountered some kind of threat each month.In this section, we explore emerging threats, evolving techniques and notable shifts in global threat patterns that challenge what has traditionally been expected.

<h3 class="text-align-justify">Remote access exploited by threat actors</h3>Malicious remote access threats showed a significant increase during the first half of Q2/2025. The risk ratio of such threats increased by 62.13% quarter-over-quarter and affected many countries, including France, South Korea, and Brazil.The largest share of malicious remote access activity continues to come from Remote Access Trojans (RATs), led by Wincir, a threat that resurged in Q1/2025. We observed a significant wave of Wincir infections, with the highest risk ratios occurring in African countries and Asia. Wincir is frequently delivered via Scam-Yourself Attacks, and we have seen threat actors abuse the MEGA Cloud storage service to host the final payload.Mirai, the notorious IoT botnet which spreads by attacking vulnerable devices, also ramped up its activity this quarter, prominently targeting China, with notable increases in Hungary, Czechia and Spain.

However, remote access can be also exploited for distribution of malicious files or downloading payloads from file-sharing platforms and cloud services. We’ve spotted threat actors leveraging Microsoft OneDrive more frequently as a key component of their attack chains, exploiting synchronization processes to deliver malicious files.&nbsp;<h3 class="text-align-justify">Scams: Consistent tactics, new channels</h3>Scams are the most prevalent threat on mobile and the second most prevalent malware type overall. Even though the tactics used by scammers are repeated over and over – such as creating a sense of urgency, playing on emotions and vulnerabilities and making potential victims doubt themselves – the specific ways in which scammers achieve their goals evolve over time. Technical Support Scams (TSS)&nbsp;increased their risk in Q2/2025 by 64.69%, marked by systematically higher activity throughout the entire quarter. From a geographical perspective, the distribution of risk has shifted. For the first time in several quarters, Japan was overtaken by other countries in terms of risk ratio. Notably:<ul><li>Austria experienced a quarter-on-quarter increase of 83%.</li><li>Germany saw a dramatic spike of 178%.</li><li>France, while not in the top three, still showed a significant increase of 119%, making it a country to watch closely.</li></ul>A particularly noteworthy development this quarter was the emergence of Facebook as an infection vector, with 14% of all blocked threats on Facebook being Technical Support Scams. While the misuse of Facebook through paid advertisements, fake posts and fraudulent user accounts has long been associated with other scam types such as investment fraud and marketplace scams, its use in Technical Support Scams represents a new trend.The landing page to which users are redirected usually imitates the Facebook Messenger interface.

These pages are typically crafted to prompt user interaction, after which the attackers lock the victim’s browser, creating a sense of urgency and panic. This tactic is consistent with traditional Technical Support Scam behavior but now appears to be expanding into social media environments to increase reach and effectiveness.

As is typical for Technical Support Scam scenarios, a phone number to a fake help line is later presented to the victim, looking for a solution.Sextortion Scams are a serious concern, as they manipulate victims by exploiting fear, shame and blackmail. These threats usually spread via email and often come in waves. This quarter, Sextortion Scams showed a 101% increase in risk ratio, mainly due to two significant waves in April and June, with notably higher peaks. The tactics remained the same: simple emails threatening to expose the content gained by alleged hacking of a victim’s device (usually a video or photos of the victim in sensitive situations, which can be artificially created or don’t exist at all). Their repeated occurrence shows an undying motivation of the attackers combined with a non-zero success rate and ease of carrying out such attacks.

Financial Scams&nbsp;showed a significant 340% increase in risk ratio during Q2/2025. This affected major countries including the United States, France, the UK and Germany. The increased activity of Financial Scams affected both desktop and mobile devices, the latter caused by ads from Meta, especially on Instagram, which are primarily viewed by users on mobile devices. However, ads were shared across all social media platforms.

When it comes to Financial Scams, we have identified three ways in which data is typically obtained from users. In the first, an advertisement redirects to a landing page, which often supports the narrative presented in the advertisement. In another example, an advertisement is used for drawing attention to the risks of scams and at the same time offers help. In some cases, attackers use a Facebook form or a Messenger bot, both serving as a way for the scammers to contact their victims and lure them into their fraudulent schemes.

Alongside financial scams, Invoice Scams became also very active in the second half of Q2/2025, similarly to the previous quarter. This involved the use of fake invoices to impersonate legitimate companies to obtain money.

<h3 class="text-align-justify">Malvertising heavily uses malicious push notifications</h3>Even though malvertising as a potential infection chain was on a slight decline in Q2/2025, this was not the case for malicious Push Notifications employed by malvertising. While their activity was relatively stable in Q1/2025, it grew significantly in Q2/2025 with a 317% increase in risk ratio, spiking primarily at the beginning and end of the quarter.

Push Notifications can take various forms, including pages designed to mimic well-known video players. These prompts often feature multiple animations to entice users to click on them. In the case of the top-hitting sample below, the design mimics CAPTCHA.

The outcome is immediate: users are bombarded with numerous push notifications delivering varied content. These often include affiliate promotions for legitimate antivirus brands with warnings about malware, advertisements for dating sites or imitations of system messages.People are victimized by feeling an urgent need to click something that has popped up on their device without warning, resulting in malicious payloads being downloaded or sensitive information being shared.

<h3 class="text-align-justify">Identity and personal data protection trends</h3>Last quarter, we reported on the severity of data breaches as we entered 2025. This quarter was no different. Data breach events rose by nearly 21% in Q2/2025. Even though the overall number of breached records exposed in this way decreased, the number of breached emails increased by 16%.Among the notable breaches discussed this quarter was an X (formerly Twitter) data leak that likely occurred in Q1/2025 but became public in April 2025. The breach exposed over 200M records of X accounts alongside their correlated emails. This breached information was combined with previously leaked data from 2023. The second notable breach was an exposure of various personal records including employment, WeChat accounts, bank accounts and other personal data in China. Additionally, reports emerged about a massive database containing 16 billion passwords being hacked; however,&nbsp;<a href="https://www.gendigital.com/blog/insights/research/16-billion-passwords-leaked">further analysis</a> revealed that these credentials were largely aggregated from past breaches, many being outdated or duplicates.&nbsp;When it comes to identity protection, Gen saw Financial and Transaction Alerts increase by 22.84% and 7.45% quarter-over-quarter, respectively. However, compared to all identity-related alerts, Credit Alerts were still the most prevalent category, led by monthly credit score updates, instant credit inquiries and new account creations.Credit Alerts originate from multiple credit bureaus tracking changes in people’s credit profiles, such as new accounts and credit inquiries. Their primary goal is to notify an individual of potential fraud attempts, personal information changes or suspicious activity in real time. As this category represents a majority of identity alerts sent, we’ll analyze it in more detail.&nbsp;

The largest portion of these alerts come from Monthly Credit Score updates (65%), which provide routine insights into credit health, helping people track changes and detect unusual drops that may signal identity theft or unauthorized activity. Instant Credit Inquiry alerts (7%) notify individuals when a lender checks their credit, often a first sign of fraudulent applications. Similarly, New Account alerts (7%) flag the creation of new credit lines, which may indicate identity misuse if unrecognized. Credit Balance Change alerts (6%) and Credit Limit Change alerts (5%) help people monitor unexpected changes in credit utilization or available credit, both of which can affect credit scores and signal suspicious behavior.While not all Credit Alerts indicate fraud, these alerts are an important part of protecting yourself and your financial position.<h3 class="text-align-justify">Threats impacting small businesses</h3>While small businesses face distinct cybersecurity challenges, we see a great deal of overlap between what impacts small businesses and the issues individuals face. For both types of victims, social engineering remains king, but while malvertising remains the dominant threat for individuals in Q2/2025, scams top the list for small businesses. Small business threats are also focused more targeted data-stealing malware like infostealers and malicious droppers, followed by exploits and malicious remote access threats. This reflects attackers’ preference for traditional malware methods when targeting business entities.

While the risk ratio for scams on desktop is 10.96% when looking at a combination of both individual and small business users, for small businesses the risk was 5.68% in Q2/2025. The lower risk ratio of scams for businesses can be influenced by many factors, from businesses having their own security measures to people being more careful when it comes to their digital lives at work.<h3 class="text-align-justify">The return of DealPly: Adware’s unexpected revival</h3>Adware saw a decline during the first months of 2025, with strains that saw massive gains at the end of 2024 – such as BrowserKnocker, Popunder and DealPly – seeing sharp drops and BrowserKnocker and DealPly nearly disappearing from our telemetry. We attributed this to the shutting down of host domains, takedowns of hosted browser add-ons and decreased activity of the operators behind these adware threats.

But not one to be kept down, DealPly completely revived its presence in late May, with a more than quadruple increase in protected users. By all accounts, DealPly resurrected several previously used domains that helped propagate its browser add-on activity. Various Google Chrome extensions that were used in the past to harvest statistical and search data appear to be back online. Users worldwide were subjected to an increased barrage of adverts and obstructive redirects due to this resurgence.

On a country-by-country basis, we observe massive spikes in Brazil where DealPly multiplied its presence in terms of risk ratio by a factor of more than 25 in the space of a few days. The US and France saw a similar trend with respective fivefold and threefold increases in a short span of time. India experienced a more than 15 times the risk in a few days as well. In all the above-mentioned countries, DealPly kept the significantly increased impact through the end of the quarter. We estimate that this will continue into the next quarter as well, demonstrating that even though threats may seem extinct one day, they can completely revive the next – and both security companies and people need to ready for such changes.Patrik Holop,&nbsp;Principal Data Scientist Luis Corrons,&nbsp;Security Evangelist Branislav Kramár, Sr Threat Analysis Engineer Jakub Vávra, Sr Threat Analysis Engineer Ondřej Mokoš, Sr Principal Threat Analysis Engineer Alexej Savčin, Threat Analysis Engineering Manager<h2>Featured stories: Q2/2025 – Inside today’s cybercrime empires</h2>Cybercriminal groups today are smarter, faster and increasingly innovative. Their infrastructures rapidly evolve, their tactics grow more deceptive, and their operations span continents. In this section, we expose three distinct threats: MediPhantom's fake pharmaceutical empire, FunkSec's short-lived but destructive ransomware campaign and the relentless data-stealing business model of Lumma Stealer. Explore how these cyber actors operate, adapt and sometimes thrive and learn about the insights and actions essential to disrupting their dangerous endeavors.<h2>PharmaFraud: Exposing the hidden empire of illegal online pharmacies</h2>It's late, and you're urgently searching online for medication, perhaps a crucial antibiotic, an expensive weight-loss treatment or even something you’d rather not discuss openly. Among the search results, a polished website catches your eye: professional graphics, reassuring badges and low prices.&nbsp;It’s exactly what you need, exactly when you need it. It seems perfect, almost too good to be true.&nbsp;Because it is.Over 95% of online pharmacies <a href="https://pmc.ncbi.nlm.nih.gov/articles/PMC9413741/">operate illegally</a>, selling counterfeit, unapproved or prescription drugs without proper authorization. And, when factoring the online pharmacies that only advertise medications to take payment but never actually deliver, the number of fraudulent pharmacies online is likely even higher. These fake online pharmacies are what Gen refers to as PharmaFraud.Behind PharmaFraud’s slick websites lurks a sophisticated, coordinated cybercrime infrastructure, meticulously designed to defraud unsuspecting victims and put their health and safety at serious risk. An extensive investigation by Gen has uncovered the dark machinery powering thousands of fraudulent online pharmacies.<h3 class="text-align-justify">A single shadowy empire</h3>Our analysis connected thousands of seemingly independent pharmacy websites to a single, highly organized cybercriminal group we have named MediPhantom. This cyber gang orchestrates a vast, scalable infrastructure with remarkable precision. MediPhantom leverages advanced techniques such as hijacking legitimate medical websites, manipulating Google search rankings and exploiting public hosting platforms. Their strategy is disturbingly effective: victims are funneled seamlessly through spam emails, advertisements on adult websites, fake health blogs, misleading review platforms and even AI-powered chatbot recommendations.<h3 class="text-align-justify">Exploiting human vulnerability</h3>The cybercriminals target medications driven by desperation or stigma: erectile dysfunction treatments, essential antibiotics like Amoxicillin, trendy and costly weight-loss drugs and even antivirals falsely marketed during flu seasons and global health crises.&nbsp;Victims seeking these medications online unknowingly risk purchasing counterfeit or contaminated products, potentially leading to severe health consequences. Beyond the physical risks, they expose themselves to financial fraud and identity theft, as cybercriminals harvest personal data through malicious payment gateways fully under their control.<h3 class="text-align-justify">How the scam works</h3>We unraveled the cybercriminals' elaborate techniques, starting with a carefully executed reconnaissance phase. Criminals monitor public forums and social media to identify high-demand medications. They then weaponize this information, crafting fake pharmacy websites and registering deceptive domains.Victims are reached via two primary methods:<ul><li>Active methods: Spam campaigns are commonly used, where attackers send promotional emails that closely resemble legitimate pharmacy flyers, enticing victims to click on links that lead directly to fraudulent sites. Another tactic involves deceptive banner advertisements strategically placed on websites hosting adult or explicit content, occasionally appearing even on mainstream platforms like Facebook and YouTube.</li></ul>

Additionally, criminals utilize fake health blogs featuring AI-generated wellness articles. These blogs are multilingual and specifically optimized for search engine visibility, embedding deceptive banners within articles to redirect visitors subtly yet effectively to scam pharmacy websites. Furthermore, fraudulent review sites, such as PharmReviews[.]net, rank fake pharmacies highly and misleadingly, creating an illusion of trustworthiness through manipulated ratings and fabricated positive customer feedback.<ul><li>Passive methods: Criminals manipulate legitimate website rankings and inject malicious content into trusted sites, redirecting unsuspecting users directly into their scams.</li></ul>While active methods often involve legally questionable tactics like spam and fake reviews, passive methods typically require unauthorized access to compromised web servers, making them more technically sophisticated and complex to detect.Once the victim lands on a fraudulent pharmacy website, they proceed through a seemingly typical shopping workflow, ultimately leading to exploitation –usually stolen funds or credentials.The purchasing process mimics legitimate e-commerce platforms: the user adds items to a cart and proceeds to checkout. However, the payment gateway is typically hosted in a separate domain that the attackers fully control, so there is no secure or legitimate payment processor.To complete the purchase, the victim is prompted to enter private contact details and payment information, usually a credit card or cryptocurrency wallet which offers a 10% discount. Since the payment gateway is under the attacker’s control, all submitted data is directly transmitted to the threat actor.

<h3 class="text-align-justify">The invisible infrastructure</h3>Beneath these fraudulent storefronts lies a robust infrastructure, meticulously documented through our investigation:<ul><li>Over 5,000 domains were identified, continually rotating to evade detection.</li><li>Around 60 unique domains host fraudulent payment gateways, most of which reuse a common template, while a few use dynamic gateways that select from over 20 templates based on context.</li><li>Real human operators manage sophisticated live-chat systems to build trust.</li><li>Centralized phone systems operate like call centers to handle victim inquiries.</li></ul>During our research, we simulated the ordering process using test payment cards. Orders were typically confirmed, but when transactions failed, the sites used clever social engineering to push victims toward completing payment. In some cases, users were told, "If our system can't accept your card, you will receive the payment details to complete the payment. In this case, there will be no call confirmation, but make sure that all the information is correct." Other variations included prompts like, "Please make sure your card allows online transactions," or "If your order is not approved within 24 hours, your credit card might be blocked for internet transactions. Please get in touch with your bank and ask to remove the block." These messages are designed to blur the line between technical error and urgency, nudging victims to bypass their security instincts, and complete the transaction at any cost.Despite diverse branding, the infrastructure consistently traces back to MediPhantom, the single, highly organized threat actor orchestrating a vast network of fake pharmacy websites. Frequent changes observed over short timeframes (often within weeks) suggest high operational activity, likely aimed at evading detection or reflecting ongoing infrastructure restructuring.Our telemetry data reveals alarming global reach and scale. Fake pharmacy operations spike during peak periods, notably around holidays like Christmas, leveraging increased online activity. The cybercriminals operate multilingual platforms targeting regions such as Southeastern Europe (Greece, Croatia, Hungary), Central Europe (Germany, Switzerland, Austria), Western Europe (France, Spain) and extend their reach to the USA, Canada, Japan and Australia.<h3 class="text-align-justify">Beyond the scam: Real-world risks of fake medications</h3>The damage caused by PharmaFraud does not end with stolen money or compromised identities. It reaches deep into the lives and bodies of those who take the pills. Counterfeit medications sold by these fraudulent websites often bypass every safeguard built into legitimate pharmaceutical supply chains.Unlike regulated drugs, which undergo strict quality control and precise dosing, fake pills may contain no active ingredients at all or dangerously high amounts. Some are laced with toxic additives, including heavy metals or unknown chemicals. In the most tragic of cases, some medications can be laced with life-threatening substances. In one U.S. enforcement case in late 2024, a network of fake online pharmacies sold millions of fentanyl-laced painkillers, killing at least&nbsp;<a href="https://www.justice.gov/usao-sdny/pr/us-attorney-announces-charges-against-18-defendants-scheme-manufacture-and-distribute">nine confirmed victims</a>. The DEA’s 2023 data showed a record 80 million fake pills seized nationwide; evidence of how deeply the problem has penetrated.

Health risks include everything from allergic reactions to treatment failure. In lab testing, over a third of pills from rogue pharmacies had no active ingredient. Patients depending on these drugs may see their conditions worsen, believing they are being treated when they are not. In the worst cases, a single counterfeit tablet can be fatal.The global nature of this threat is equally alarming. In Europe, despite strong regulations and the EU’s pharmacy logo system, fake sites have surged, especially during drug shortages or health crises. During the COVID-19 pandemic, fake pharmacies in France pushed counterfeit chloroquine as a miracle cure. In Germany and Japan, fake or unauthorized sellers targeted consumers searching for restricted medications or lifestyle treatments like erectile dysfunction drugs and diet pills. Japan’s strict laws prohibit online prescription drug sales, yet customs officials there have intercepted&nbsp;<a href="https://www.jpma.or.jp/english/globalhealth/fake_measures/about_fake_measures.html">hundreds of thousands of counterfeit shipments</a> and shut down over 2,300 websites.Even packaging can mislead. Criminals mimic logos, pill shapes and labels. But there are clues: no lot of numbers, poor-quality printing, suspicious expiry dates or pills that look slightly off. Still, to the average consumer, a fake pill often looks indistinguishable from the real thing until it fails or causes harm.And the demand is high. In the U.S., high drug prices have pushed people to seek alternatives.&nbsp;<a href="https://www.aarp.org/money/scams-fraud/online-pharmacy/">Surveys show</a> that 1 in 9 adults, and 1 in 6 among those over 55, have purchased medication online. That is a massive target audience. And cybercriminals like MediPhantom know it.<h3 class="text-align-justify">Taking action and fighting back</h3>At Gen, we are proactively working to disrupt these PharmaFraud activities. Our dedicated cybersecurity team continuously monitors, identifies and blocks fraudulent domains and payment gateways. By leveraging advanced network analysis, we rapidly detect new malicious sites and quickly neutralize threats, significantly limiting their ability to exploit consumers.But the fight does not end there. We collaborate closely with international law enforcement agencies, sharing intelligence and supporting coordinated global takedown efforts. Together, through constant vigilance, sophisticated technological solutions and strengthened international cooperation, we are committed to dismantling this dangerous empire piece by piece, protecting consumers worldwide from online pharmaceutical fraud. Our goal is clear: to educate people about PharmaFraud and make MediPhantom’s infrastructure visible, vulnerable, and ultimately, dismantled.<h2>Beating FunkSec: When ransomware meets AI</h2>It started like any other ransomware story: encryption, extortion and chaos. But this time, the ending was different, and it’s not because the criminals suddenly grew a conscience.FunkSec ransomware emerged in late 2024, but its full operation unfolded in phases. The gang’s leak site listed its first victim as early as December 4 and suggested that their initial tactic was data exfiltration and extortion without encryption. The ransomware component came later. Based on available evidence, the ransomware development likely began in mid-December, with the first known sample dated December 31, 2024, just in time to ruin someone’s New Year’s Eve. And by January 1, a company working in the child protection sector had already been listed as a victim.FunkSec was written in Rust, a modern programming language gaining traction in both cybersecurity tools and advanced malware due to its speed and memory safety. Leveraging the orion-rs cryptographic library, FunkSec encrypted victims' files using ChaCha20 and dropped a ransom note named README-{random}.md in every folder, appending the extension “.funksec” to all encrypted data. It was designed to kill dozens of services and processes to maximize disruption, including browsers, media players, email clients and even Task Manager.

Interestingly, some samples attempted to load a desktop wallpaper image from imgur[.]com as part of the data-encryption process. While not critical to its function, it shows how threat actors are experimenting with small touches of psychological manipulation or branding, even in destructive tools.

While FunkSec wasn’t the most technically advanced ransomware, the damage was real. In just a few months, the gang targeted over 100 organizations&nbsp;worldwide, including companies in the U.S., Italy, Spain, Brazil among others. The ransom demand was modest: 0.1 Bitcoin per victim. But with 113 companies listed on their leak site, the potential haul amounted to more than $1.1 million at today’s rates. Not bad for a short-lived, bug-prone operation.And behind the scenes, something more alarming was taking shape: AI.The FunkSec operators admitted to using AI to assist in parts of their operations, including tooling, phishing templates, and code snippets. While they estimated that AI accounted for only about 20% of their workflow, it was enough to raise concerns. This may be one of the first publicly known cases of ransomware development partially assisted by generative AI.<h3 class="text-align-justify">Quiet victories and free help</h3>But here’s where the story takes a turn.A team of researchers at Gen quietly discovered a cryptographic flaw in FunkSec’s encryption logic. We won’t reveal the details, even now, to avoid giving future threat actors a blueprint for improvement. But the vulnerability was significant enough to allow us to do what we are committed to doing whenever possible: help victims recover their data without paying the ransom.Over the next few months, Gen collaborated discreetly with global law enforcement agencies, including ransomware investigators across the U.S. and Europe, providing support to help impacted victims regain access to their files through a free decryptor tool. The decryptor remained private throughout this phase to prevent detection or sabotage by the attackers.Now that FunkSec has gone quiet (the last known victim was attacked on March 15), the decryptor is being made publicly available, including through the&nbsp;<a href="https://www.nomoreransom.org/">NoMoreRansom</a> initiative. We’ve made our ransomware decryptor available for direct <a href="https://files.avast.com/files/decryptor/avast_decryptor_funksec64.exe" target="_blank">download here</a>.&nbsp;<h4 class="text-align-justify">Lessons from FunkSec</h4><ul><li>AI is entering the ransomware workflow. Even in limited form, generative AI is speeding up the development of cybercrime tools.</li><li>One crypto mistake can change everything. A flaw in the math helped dozens of victims avoid extortion and recover their data.</li><li>Law enforcement collaboration works. Coordinated, quiet support can stop ransomware without tipping off the enemy.</li><li>Ransomware doesn’t need to be perfect to be dangerous. Even experimental, buggy strains can hit real people and cause real harm.</li></ul>The Avast FunkSec Ransomware Decryptor is just the latest, most recent in a list of over 40 free ransomware decryptors released under the AVG and Avast brands over the past decade. Ransomware isn’t going away. But stories like this remind us: when researchers and law enforcement join forces, it’s the criminals who end up losing control.<h2>Lumma disrupted. But is the beast dead?</h2>Imagine taking down one of the world's largest infostealer infrastructures: servers shut, command centers offline and criminals scrambling.&nbsp;<a href="https://www.europol.europa.eu/media-press/newsroom/news/europol-and-microsoft-disrupt-world%E2%80%99s-largest-infostealer-lumma">Europol</a>, in collaboration with Microsoft, achieved precisely that in a spectacular operation targeting Lumma Stealer, the malware-as-a-service titan notorious for harvesting sensitive data worldwide.But here’s the question: Has the giant truly fallen or merely stumbled?<h3 class="text-align-justify">A long-standing threat</h3>Lumma Stealer has been a recurring subject in our threat reports over the years, known for its adaptability and widespread use in various campaigns. Its operators have employed sophisticated social engineering tactics, such as Fake CAPTCHA pages, to trick users into executing malicious scripts and giving the infostealer access to their devices. These deceptive methods have been documented in multiple analyses, highlighting the malware's evolution and the ingenuity of its distribution strategies.Gen Threat Labs has extensively researched how attackers use&nbsp;<a href="https://blog.avast.com/fakecaptcha-scams">Fake CAPTCHAs</a> to distribute malware, specifically mentioning Lumma Stealer as a commonly deployed threat in these attacks. Additionally, Lumma Stealer has been observed&nbsp;<a href="https://press.avast.com/deepfakes-ai-manipulated-audio-and-hijacked-social-media-surge-in-2024?utm_source=chatgpt.com">exploiting platforms like YouTube</a> to spread via cracked software propagated through Fake Tutorials.The success of all the techniques in Lumma Stealer’s toolbox resulted in a 1154% increase in activity during Q3/2024, indicating its aggressive proliferation and the effectiveness of its distribution tactics.<h3 class="text-align-justify">Distribution uninterrupted: Lumma’s silent persistence&nbsp;</h3>Gen telemetry from May, captured in the aftermath of Lumma Stealer’s takedown by Europol, reveals a troubling but not unexpected resilience. Instead of plunging dramatically, Lumma infection attempts continued steadily. Distribution channels, untouched by the operation, remain open and active, meaning Lumma is still knocking at users' doors. So how is it that Lumma was able to remain undisturbed after a successful governmental takedown?&nbsp;

The answer boils down to how Lumma operates. The Europol and Microsoft intervention primarily targeted the Command-and-Control (C2) servers and administration panels, effectively cutting off the stealer’s ability to relay stolen data. But the malware itself, persistently distributed through phishing emails, fake software updates and other&nbsp;<a href="https://www.gendigital.com/blog/insights/research/lumma-stealer-github">deceptive tactics</a>, still infects new victims' devices daily.In short, while the operation severed Lumma’s command structure, it failed to halt the distribution pipelines. Our internal data, highlighting a stable infection rate throughout May and the rest of Q2/2025, confirms this grim reality: Lumma’s reach remains alarmingly consistent.<h3 class="text-align-justify">Infrastructure resurrection: Lumma's swift recovery</h3>Even though Lumma Stealer continued to be widely distributed after the takedown, the critical question was whether attackers had managed to re-establish their exfiltration infrastructure or if they were simply relying on short-term capabilities of its distribution network. Did the disruption impact its exfiltration capabilities in the long run? Could the attackers recover, restore and deploy new infrastructure to receive logs?We’ve been closely monitoring Lumma’s use of dead drop resolvers,&nbsp;a technique that enables infected machines to dynamically retrieve updated command-and-control (C2) addresses. This mechanism allows threat actors to rotate infrastructure frequently without needing to redeploy the malware itself. In recent weeks, we’ve resolved multiple fresh C2 domains, clearly indicating an active and ongoing effort to maintain exfiltration capabilities.

In parallel, we uncovered a misconfigured administration panel tied to one of Lumma’s ongoing operations. It revealed thousands of logs, over 500 linked to cryptocurrency wallets, and a 3.5% “success rate” (wallets to total logs). Victims span over 100 countries, with Indonesia, the Philippines and Egypt topping the chart. We’ve observed the number of logs continuously increasing, clearly indicating that exfiltration is not just possible; it’s actively happening.

Together, these findings confirm that Lumma’s infrastructure wasn’t dismantled. It’s been resilient all along and barely missed a beat.<h3 class="text-align-justify">The reputational impact</h3>Despite the unsettling evidence of Lumma’s operational recovery, the takedown achieved a critical and perhaps more lasting impact: reputational damage.&nbsp;Lumma’s trustworthiness and reliability, central to its infamous Malware-as-a-Service (MaaS) operations, have dealt a massive reputational blow. Potential affiliate partners are now hesitant, wary of law enforcement scrutiny and the possibility of compromised infrastructures.History teaches us that in the dark corners of cybercrime, reputation often matters as much (if not more) as technological prowess. After all, cybercriminals thrive on trust among thieves. Once broken, regaining credibility can be even harder than rebuilding infrastructure.The partial disruption of Lumma Stealer is not an isolated victory. Recent months have witnessed several notable successes thanks to extensive international collaboration among law enforcement agencies and private sector entities. In the U.S., authorities indicted the leader behind the Qakbot botnet, notorious for facilitating major ransomware attacks. Separately, the DanaBot malware, responsible for infecting countless computers, saw its operators federally charged. Meanwhile, Europol’s Operation Endgame broke critical links in the ransomware kill chain by dismantling vital criminal networks at their very source.What these coordinated takedowns make evident is that cross-border cooperation, information sharing and joint operations between law enforcement and cybersecurity companies are increasingly effective. While no single action fully eradicates cyber threats, each disruption chips away at criminal capabilities, degrades operational trust, and collectively raises the cost for cybercriminals globally.<h3 class="text-align-justify">What happens next?</h3>As our investigation continues, we remain vigilant, closely monitoring Lumma’s evolving activity. For now, the beast appears wounded, not defeated. Its distribution network remains operational, infrastructure reconstruction efforts are ongoing, and yet the trust Lumma once commanded lies significantly damaged.Stay tuned as we keep our finger on the pulse of this evolving story, uncovering whether Lumma Stealer can rise again or if this is the beginning of its ultimate downfall.Jan Rubín, Threat Research Team Lead Ladislav Zezula, Malware Researcher Ľuboš Bever, Malware Researcher Luis Corrons,&nbsp;Security Evangelist Martin Chlumecký, Malware Researcher<h2 class="text-align-justify">In closing</h2>The digital underground is a constantly shifting landscape, marked by rapid adaptation and ruthless innovation. As threat actors become more sophisticated, understanding their operational nuances becomes critical. By analyzing cases like Lumma Stealer infostealer, FunkSec ransomware, and the MediPhantom fake pharmacy gang, we equip ourselves not only to defend against present threats but to anticipate and disrupt emerging ones. Our collective vigilance and adaptability remain our strongest assets in confronting the evolving world of cybercrime.&nbsp;

<h2>Download the <a href="https://cmsb.nortonlifelock.com/sites/default/files/2025-07/Q22025%20Gen%20Threat%20Report%20%20%28Booklets%29%20%284%29.pdf" target="_blank">Q2/2025 Threat Report Key Highlights</a></h2>Visit our <a href="https://www.gendigital.com/blog/insights/reports/threat-taxonomy" target="_blank" title="Glossary">Glossary and Taxonomy</a> for clear definitions and insights into how we classify today’s cyberthreats.

AI ransomware cracked without paying, fake pharmacy network unmasked and Lumma still alive after takedown

Gen Q2/2025 Threat Report

<h2>Foreword&nbsp;</h2>With this issue of the Gen Threat Report, we are introducing a more streamlined format, making it easier to digest and focusing more on key highlights, trends and emerging threats rather than attempting to catalog every detail. The Threat Landscape Highlights section will capture notable trends and evolving threat dynamics, and Featured Stories will now dive deeper into specific investigations.&nbsp;&nbsp;The threat landscape in Q1/2025 might look surprising to some. At first glance, the decline in the total number of blocked attacks compared to the previous quarter might seem like a welcome reduction in activity. However, this drop is not solely seasonal or due to reduced attacker activity. More importantly, this decrease highlights a deeper evolution in tactics: broad 'spray and pray' campaigns are giving way to more tailored, deceptive and persistent attacks. The threats that did emerge this quarter are more focused, strategic and reflect the growing sophistication of attackers.&nbsp;

Financial threats showed new levels of innovation. The CryptoCore group executed one of its most refined campaigns to date, blending deepfake videos of public figures, compromised YouTube accounts and professionally cloned websites. This most recent campaign resulted in an estimated $3.8 million in illicit profits over 2,200 transactions (although the real number is likely far higher). Mobile financial threats also escalated. The Crocodilus banking trojan, most active in Spain and Turkey, abused accessibility features to overlay fake login pages and steal crypto wallet credentials. Meanwhile, our LifeLock insights showed rising levels of credit and transaction alerts, indicating both increased monitoring activity and more frequent fraud attempts targeting users’ financial footprints.&nbsp;Data-stealing threats also continued to rise across multiple categories based on our telemetry. The number of data breach events — meaning instances where a company or platform was breached — increased by more than 36% quarter over quarter, while the total number of breached records — or personal data such as email, passwords, credit card numbers, etc. — surged by more than 186%. While large-scale service breaches made headlines, attackers were also using direct compromise of user data through infostealers such as Lumma Stealer (which has since been successfully taken down through a <a href="https://www.europol.europa.eu/media-press/newsroom/news/europol-and-microsoft-disrupt-world%E2%80%99s-largest-infostealer-lumma" target="_blank" rel="noreferrer noopener">collaboration between Europol and Microsoft</a>). Furthermore, phishing continued to play a growing role in data compromise — we documented how adversaries are abusing low-code form-building platforms to host phishing campaigns on legitimate infrastructure, making detection and takedown significantly harder. Lastly, ransomware remained a high-risk threat, building over the last three quarters. The majority of cases continued to be driven by the usual suspect, Magniber, but new strains, such as FunkSec, also emerged. FunkSec, in particular, had been allegedly partially generated using AI and large language models (LLMs).&nbsp;Scam threats were marked by significant diversification and reach. We protected more than 4 million people from Scam-Yourself Attacks, a category that now spans platforms and operating systems. FakeCaptcha, once confined to Windows, expanded to macOS and began distributing the infamous infostealer AMOS (Atomic Stealer) under the guise of phishing protection. Touché. Moreover, social media remained a key vector for scams, with compromised Facebook and YouTube accounts used for both distribution and monetization. Attackers combined AI-generated personas, hired influencers and platform-native ad systems to lend legitimacy to fraudulent campaigns. In parallel, Fake Update attacks, another type of Scam-Yourself Attack in which people are asked to update their device or programs but are instead guided to infect their devices, targeted European users causing an unprecedented growth of 17 times of the risk exposure compared to last quarter.&nbsp;We hope you find the Q1/2025 Gen Threat Report engaging and informative and the new format easy to digest. Thank you for reading. &nbsp;Jakub Křoustek, Threat Research Director&nbsp;&nbsp;

<h2>Threat Landscape Highlights</h2>While the list of the most prevalent threat type remains the same or nearly similar throughout the years, the threat landscape continuously evolves through the ways in which threat actors work to achieve their malicious ambitions. How the landscape shifts is inevitably affected by our digital activities, from the use of social media to online shopping and learning to recent events affecting the security of our digital lives, such as data breaches.&nbsp;&nbsp;In this section, we aim to provide insight into emerging threats, new techniques and trends and interesting changes in the otherwise expected behavior of the global threat landscape.&nbsp;

<h3>Global Risk Snapshot&nbsp;</h3>Global risk ratio: 24.53%&nbsp;Cyber risk remained high in Q1/2025, with a global average risk ratio of 24.53%, consistent with the heightened levels observed in late 2024. However, exposure remained highly uneven across regions.&nbsp;

The highest threat activity concentrated in parts of Asia and Eastern Europe. China topped the list with a risk ratio of 48.60%, followed by Georgia (44.51%) and Vietnam (39.06%). These figures reflect a mix of aggressive targeting, insufficient defensive infrastructure and high digital engagement.&nbsp;In contrast, major economies like Japan (16.12%), Germany (20.11%) and France (24.93%) reported significantly lower risk ratios, while Scandinavian countries like Finland (19.36%), Sweden (22.14%) and Norway (23.96%) continued to show resilience against attacks thanks to mature cybersecurity practices.&nbsp;South America remained a region of interest, with Brazil (20.14%) and Argentina (23.24%) experiencing spikes in mobile-specific threats. Meanwhile, countries with limited digital infrastructure — such as Haiti (18.44%) or the Democratic Republic of Congo (16.24%) — saw reduced exposure simply due to lower internet penetration.&nbsp;

<h3>Personal Data at Stake: Data Breaches &amp; Information Stealers&nbsp;</h3>Personal data is like digital gold to criminals, and risks to digital identities continue to increase. Based on our telemetry, data breach events - instances where a company or platform was breached - rose 36.12% quarter-over-quarter. Breached records increased by 186.26%, with breached user emails alone up 102.93%. More than 1.19 million records were reported with high or critical severity, meaning that the breached records also included plaintext passwords, potentially giving cybercriminals the figurative keys to over a million of people’s personal accounts.&nbsp;Large-scale data breaches are no longer rare. Notable digital-identity events in Q1/2025 included:&nbsp;<ul><li>USOSGM: Exposed full names and addresses of U.S. shoppers.</li><li>ALIEN TXTBASE: Huge collection of stolen user credentials published on Telegram channel—493 million unique website and email address pairs, affecting 284 million unique email addresses.&nbsp;</li></ul>One of the protective measures we provide for our users is alerting them when a significant breach happens and their personal data is exposed or possibly affected by a recent data leak. These alerts give our customers the opportunity to responsibly react and secure their personal data in advance of fraudulent activity by attackers. In Q1/2025, alerted users increased too with notable spikes in:&nbsp;<ul><li>Credit Alerts: +13.83%. These alerts are related to new accounts, credit inquiries, changes in credit profiles, etc., and they notify users of potential fraud attempts or suspicious activity in real time.</li><li>Criminal Record Alerts: +11.98%. These are related to users' identity appearing in legal or criminal records, including court cases, judgments, and sex offender notifications. These alerts inform users of potential misuse of their identity or unauthorized legal associations.</li><li>Transaction Alerts: +3.04%. Transaction alerts track financial transactions across users’ bank accounts, credit cards, and investment accounts. These notifications highlight unusual charges, threshold limits were exceeded, or payday loan applications.&nbsp;</li></ul>Data stealing efforts via information stealers also rose in Q1/2025, with a 8.24% increase in risk ratio, again driven by the <a href="https://www.gendigital.com/blog/insights/research/lumma-stealer-github" target="_blank" rel="noreferrer noopener">Lumma Stealer</a> which:&nbsp;<ul><li>saw a +59.4% market share increase, now at 19.51%</li><li>harvested credentials, crypto wallets, 2FA tokens</li><li>delivered via phishing, GitHub abuse, and Scam-Yourself attacks&nbsp;</li></ul>Other prominent infostealers by their malware share were:&nbsp;<ul><li>FormBook (12.47%)</li><li>AgentTesla (10.99%)</li><li>Ramnit, MassLogger, Fareit, SnakeKeylogger, Lokibot&nbsp;</li></ul>

The regions most impacted by information stealers were Turkey, Egypt, Indonesia and Argentina.&nbsp;<h3>&nbsp;Scams &amp; Social Media Exploits&nbsp;</h3>Scams continue to evolve as one of the most widespread and adaptable cyberthreats, exploiting both traditional and modern delivery channels. In Q1/2025, we observed scammers leveraging everything from <a href="https://www.avast.com/c-what-is-malvertising-how-to-stop-it" target="_blank" rel="noreferrer noopener">malvertising</a> (malicious advertising) to social media platforms and push notifications to reach potential victims. This broad attack surface was amplified by the wealth of user data available online, enabling highly targeted and convincing scams. Below, we highlighted some of the key trends and tactics shaping the scam landscape this quarter:&nbsp;<ul><li>Malicious push notifications delivering scams increased 10.26% in the risk ratio for Germany, followed by Norway (+24.85%) and Denmark (+22.42%).</li><li>Financial scams increased 500% in Lebanon, 223% in Moldova, 112% in Portugal and tens of percents also in Slovakia, Serbia, Estonia and Slovenia.&nbsp;</li></ul>Social media also remained a favored delivery mechanism for scams and other related threat types. In Q1/2025, 63% of social-media-related threats were observed on Facebook, followed by YouTube with 22% platform share. Platforms like Reddit and Instagram remained a relevant threat, while X (formerly Twitter) held steady at 7%. LinkedIn, a business and employment-oriented social network, observed a rising trend with 26.23% increase of its share.&nbsp;

The types of threats found on each social media site varied due to user demographics and usage patterns, with malvertising continuing to top the threat types on social media 30% of the total share, followed by phishing (21.72%). &nbsp;Q1 Scam Trends Revealed by Norton Genie&nbsp;Our Norton Genie scam detection tool shows the different type of scams reported by users:&nbsp;<ul><li>Generic scams: 51.4%</li><li>Phishing: 31.9% with a massive 4x increase quarter-over-quarter</li><li>Malvertising: 2.41%&nbsp;&nbsp;</li></ul>

<h3>Ransomware: A Changing Battlefield&nbsp;</h3>The ransomware threat level remains elevated since Q4/2024. In Q1/2025:&nbsp;<ul><li>Magniber dominated (67% of ransomware cases and over 100,000 protected users)</li><li>WannaCry and Enigma trailed far behind&nbsp;</li></ul>

While the notable players maintain the largest share of ransomware threats, there is a new player on the ransomware scene, called FunkSec. Some of their tools were most likely generated by an LLM agent, a sign that AI tools are lowering the barrier for creating ransomware. This also applies to the <a href="https://www.virustotal.com/gui/file/7e223a685d5324491bcacf3127869f9f3ec5d5100c5e7cb5af45a227e6ab4603" target="_blank" rel="noreferrer noopener">template source code</a>, where comments are written in perfect English (as opposed to very basic English in other mediums).&nbsp;Based on a report from <a href="https://www.chainalysis.com/blog/crypto-crime-ransomware-victim-extortion-2025/" target="_blank" rel="noreferrer noopener">Chainalysis</a>, the total volume of ransom payments decreased year-over-year (YoY) by approximately 35%. There are a few reasons why the payments declined —companies have adapted to this type of cyber-threat and are understanding the need for cybersecurity while more frequently declining to pay ransomware gangs while law-enforcement agencies have increased pressure on ransomware infrastructure and crypto-mixers. The total amount paid in 2024 was $813 million.&nbsp;<h3>Mobile Threats on the Rise&nbsp;</h3>Mobile threats surged in Q1/2025, with a 25% increase in protected users across adware and spyware categories. Adware, particularly strains like HiddenAds and MobiDash, dominated the mobile threat landscape, while older families like FakeAdBlockers faded from view. Brazil, India, Argentina, and Mexico saw some of the largest country-specific spikes, with Mexico notably experiencing a 42% jump in protected monthly users.&nbsp;

The evolving nature of mobile adware and spyware suggests these threats will continue to escalate in the coming quarters, particularly as attackers experiment with new delivery methods and leverage regional campaigns to maximize impact.&nbsp;

Spyware, though growing more modestly (+6% protected users), revealed worrying trends with new or resurging strains like SpySolr, Tambir and SpyLend, targeting victims in Turkey and India with increasingly aggressive data theft and blackmail tactics. Spain stood out with a 96% spike in spyware risk, while Turkey followed closely behind at +84%.&nbsp;Patrik Holop, Researcher&nbsp; Luis Corrons, Security Evangelist&nbsp; Ladislav Zezula, Malware Researcher&nbsp; Jakub Vávra, Threat Operations Analyst&nbsp; Jan Rubín, Malware Researcher&nbsp; Alexej Savčin, Threat Analysis Engineering Manager&nbsp; Lukáš Zobal, Research Engineering Manager&nbsp;

<h2>Featured Stories: Deception, Innovation and Exploited Trust&nbsp;</h2>The first quarter of 2025 demonstrated that cybercriminals are not merely refining their methods; they’re rewriting the playbook entirely. Our Featured Stories expose how threat actors employed groundbreaking technologies, hijacked trusted platforms and used highly personalized deception to trap victims more effectively than ever.&nbsp;CryptoCore’s manipulation of deepfake technology around President Donald Trump’s 2025 inauguration illustrates how major media events can become powerful tools for financial fraud on a global scale.&nbsp;&nbsp;In parallel, cybercriminals exploit legitimate online website builders, rapidly deploying convincing phishing pages designed to bypass traditional security measures and deceive users into handing over their most sensitive data.&nbsp;We also explore the sophistication of Scam-Yourself Attacks, a disturbing trend where victims are deceived into willingly infecting their own devices. Attackers increasingly use realistic AI-generated personas, cleverly compromised social platforms and sophisticated cross-platform techniques to evade detection and persuade users to lower their defenses voluntarily.&nbsp;Together, these featured stories paint a clear picture of a threat landscape driven by innovation, deception and an alarming exploitation of trust.&nbsp;<h3>Hijacked Inauguration: How CryptoCore Used Deepfakes to Scam Millions&nbsp;</h3>CryptoCore, the sophisticated cybercriminal group that exploits the popularity of cryptocurrencies, has perfected the art of deception. By combining deepfake technology, hijacked YouTube accounts and professionally designed websites, they transform media events into launchpads for sophisticated scam operations targeting cryptocurrency users. Their approach exploits trust, manipulates public attention and turns fabricated reality into a convincing trap. We broke down their methods further in our article about <a href="https://decoded.avast.io/martinchlumecky1/cryptocore-unmasking-the-sophisticated-cryptocurrency-scam-operations/" target="_blank" rel="noreferrer noopener">CryptoCore</a>.&nbsp;In Q1/2025, CryptoCore found the perfect stage. As the 2025 inauguration of U.S. President Donald Trump captured global headlines, the group launched one of its most aggressive deepfake campaigns yet, targeting cryptocurrency enthusiasts caught in the media frenzy.&nbsp;Our telemetry shows that during this period, CryptoCore’s activity surged to over four times the typical baseline, reflecting the scale of the operation.&nbsp;&nbsp;

CryptoCore significantly increased its activity on YouTube during the inauguration, hijacking more accounts and rebranding them to look like official accounts linked to Donald Trump. Deepfake technology was at the heart of the operation, creating realistic, fabricated videos featuring both Donald Trump and Elon Musk promoting fraudulent giveaway events.&nbsp;

Gen Protects Millions of People as Breached Personal Information, Phishing Reports, Fake Browser Update Scams and Scam-Yourself Attacks Are on the Rise 