When Hackers Call: Social Engineering, Abusing Brave Support, and EncryptHub's Expanding Arsenal

Description

EncryptHub, an emerging threat group, has launched a campaign combining social engineering with exploitation of CVE-2025-26633 to deliver malicious payloads. The attackers impersonate IT support staff, use remote desktop sessions, and execute PowerShell commands to deploy malware. The campaign abuses the Brave Support platform to host payloads and employs new tools like SilentCrystal and a SOCKS5 proxy backdoor. EncryptHub also created a fake video call platform, RivaTalk, to distribute malware. The group's tactics include using AES-encrypted commands, generating fake browser traffic, and exploiting system vulnerabilities. This adaptive adversary highlights the need for layered defense strategies, ongoing threat intelligence, and user awareness training to mitigate risks.