SecuriTricks - rhadamanthys

Distribution of SmartLoader Malware via Github Repository Disguised as a Legitimate Project

A massive distribution of SmartLoader malware has been discovered through GitHub repositories masquerading as legitimate projects. These repositories focus on topics like game cheats, software cracks, and automation tools to attract users. The malware is distributed via compressed files containing …

obfuscation

rhadamanthys

Published: August 13, 2025

Downloadable IOCs: 11

MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities

A Malware-as-a-Service operation utilizing Amadey for payload delivery has been identified, with connections to a SmokeLoader phishing campaign targeting Ukrainian entities. The operation exploits fake GitHub accounts to host payloads and tools, bypassing web filtering. Emmenhtal, a multistage down…

Published: July 17, 2025

Downloadable IOCs: 4

June 2025 Infostealer Trend Report

This analysis provides insights into Infostealer malware trends observed in June 2025. The data, collected through various automated systems, reveals changes in distribution methods and malware types. While LummaC2 has been dominant, June saw increased activity from Rhadamanthys, ACRStealer, Vidar,…

anti-analysis techniques

Published: July 16, 2025

Downloadable IOCs: 0

May 2025 Infostealer Trend Report

This analysis examines the distribution trends of Infostealer malware in May 2025. It highlights the use of SEO poisoning to distribute malware disguised as cracks and keygens. LummaC2, Vidar, StealC, Rhadamanthys, and Amadey were the main Infostealers observed. Distribution methods included posts …

Published: June 18, 2025

Downloadable IOCs: 3

Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication

Proofpoint has identified Amatera Stealer, a rebranded version of ACR Stealer with enhanced capabilities and evasion techniques. Distributed via ClearFake website injects, it utilizes sophisticated attack chains and web injects. Amatera Stealer employs NTSockets for stealthy C2 communication, WoW64…

Published: June 18, 2025

Downloadable IOCs: 12

JScript to PowerShell: Breaking Down a Loader Delivering XWorm and Rhadamanthys

This analysis examines a sophisticated malware loader that utilizes JScript to launch obfuscated PowerShell code, ultimately delivering payloads such as XWorm and Rhadamanthys. The loader employs geofencing tactics, targeting victims in the United States with XWorm RAT, while deploying Rhadamanthys…

Published: April 16, 2025

Downloadable IOCs: 4

The Wagmi Manual: Copy, Paste, and Profit

The Wagmi traffer group, operating since early 2023, specializes in NFT scams and cryptocurrency theft. They utilize sophisticated social engineering tactics, fake web3-themed games, and impersonation of legitimate projects to lure victims. Their operations have allegedly earned over $2.4 million b…

Published: April 8, 2025

Downloadable IOCs: 96

Unveiling EncryptHub: Analysis of a multi-stage malware campaign

EncryptHub, an emerging cybercriminal entity, has been conducting multi-stage malware campaigns using trojanized applications and third-party distribution services. Their tactics include using PowerShell scripts for system data gathering, information exfiltration, and payload deployment. The threat…

Published: April 7, 2025

Downloadable IOCs: 69

A Deep Dive into Water Arsenal and Infrastructure

Water Gamayun, a suspected Russian threat actor, exploits the MSC EvilTwin zero-day vulnerability (CVE-2025-26633) to compromise systems and exfiltrate data. The group uses custom payloads like EncryptHub Stealer variants, SilentPrism and DarkWisp backdoors, as well as known malware like Stealc and…

Published: March 29, 2025

Downloadable IOCs: 0

CoffeeLoader: A Brew of Stealthy Techniques

CoffeeLoader is a sophisticated malware family discovered in September 2024, designed to download and execute second-stage payloads while evading detection. It employs numerous techniques to bypass security solutions, including a GPU-utilizing packer, call stack spoofing, sleep obfuscation, and Win…

Published: March 27, 2025

Downloadable IOCs: 5

Unmasking GrassCall Campaign: The Hackers Behind Job Recruitment Cyber Scams

The GrassCall malware campaign, orchestrated by the Russian-speaking cybercriminal group 'Crazy Evil,' targets job seekers in the cryptocurrency and Web3 sectors. The attackers create fake companies and job postings, luring victims into downloading malicious software disguised as a video conferenci…

russian-speaking cybercriminals

Published: March 13, 2025

Downloadable IOCs: 0

Unmasking GrassCall Campaign: The APT Behind Job Recruitment Cyber Scams

The GrassCall malware campaign is an advanced social engineering attack conducted by a Russian-speaking cybercriminal group called Crazy Evil. Targeting job seekers in the cryptocurrency and Web3 sectors, the campaign uses fake job interviews to compromise victims' systems and steal cryptocurrency …

atomic macos stealer (amos)

grasscall

Published: March 6, 2025

Downloadable IOCs: 14

Security Brief: Threat Actors Take Taxes Into Account

Proofpoint researchers have identified an increase in campaigns and malicious domains impersonating tax agencies and financial organizations. This aligns with the annual increase in tax-related content observed from December through April. Phishing lures impersonate government agencies and financia…

credential harvesting

metastealer

zgrat

malware delivery

government impersonation

Published: January 28, 2025

Downloadable IOCs: 0

Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation

This analysis examines HeartCrypt, a new packer-as-a-service (PaaS) used to protect malware. Developed since July 2023 and launched in February 2024, HeartCrypt charges $20 per file to pack Windows x86 and .NET payloads. It is primarily used by malware operators of families like LummaStealer, Remco…

Published: December 14, 2024

Downloadable IOCs: 0

NetSupport RAT and RMS in malicious emails

The Horns&Hooves campaign, active since March 2023, targets Russian businesses with malicious email attachments containing scripts that install NetSupport RAT or BurnsRAT. The campaign evolved through several versions, improving obfuscation and delivery methods. It uses decoy documents and legitima…

Published: December 2, 2024

Downloadable IOCs: 35

CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits

A large-scale phishing campaign deploying the latest version of Rhadamanthys stealer (0.7) has been discovered. The campaign, dubbed CopyRh(ight)adamantys, uses copyright infringement claims to target various regions globally. It impersonates numerous companies, mainly from Entertainment/Media and …

Published: November 6, 2024

Downloadable IOCs: 0

Threat actors use copyright infringement phishing lure to deploy infostealers

An unknown threat actor is conducting a phishing campaign targeting Facebook business and advertising account users in Taiwan. The campaign uses emails impersonating legal departments, claiming copyright infringement to lure victims into downloading malware. The attackers abuse Google's Appspot dom…

Published: October 31, 2024

Downloadable IOCs: 0

ClickFix tactic: The Phantom Meet

This analysis explores the ClickFix social engineering tactic that emerged in 2024, focusing on a cluster impersonating Google Meet pages to distribute malware. The tactic tricks users into running malicious code by displaying fake error messages. The investigated cluster targets both Windows and m…

Published: October 18, 2024

Downloadable IOCs: 171

Beware: Fake Google Meet Pages Deliver Infostealers in Ongoing ClickFix Campaign

Threat actors are using fake Google Meet web pages as part of the ClickFix campaign to deliver infostealers targeting Windows and macOS systems. The attackers display fake error messages in web browsers, tricking users into executing malicious PowerShell code. The campaign has expanded to impersona…

Published: October 18, 2024

Downloadable IOCs: 0

The Abuse of ITarian RMM by Dolphin Loader

This report explores how the Dolphin Loader, a malware-as-a-service loader, abuses the legitimate ITarian Remote Monitoring and Management (RMM) software to distribute various malware payloads. The loader leverages the built-in functionality of RMM tools, such as remote command execution and system…

Published: August 19, 2024

Downloadable IOCs: 24

RHADAMANTHYS: In-Depth Analysis of a Sophisticated Stealer Targeting Israeli Users

This comprehensive technical analysis delves into the intricate workings of an advanced and localized malware campaign employing the RHADAMANTHYS stealer. Dissecting the infection chain, anti-analysis techniques, data theft capabilities, and Command & Control infrastructure, this detailed report sh…

Published: August 5, 2024

Downloadable IOCs: 5

New Hijack Loader Variant: Uses Process Hollowing, Has Enhanced Anti-Evasion Capabilities

Published: May 23, 2024

Downloadable IOCs: 9

HijackLoader Updates

HijackLoader, also known as IDAT Loader, is a modular malware loader capable of executing multiple payloads. It utilizes a variety of modules for code injection, execution, and evasion techniques. This report analyzes the updated version of HijackLoader, which includes new modules for bypassing Win…

Published: May 7, 2024

Downloadable IOCs: 11

Tag: rhadamanthys

Attack reports

Operation Endgame vs. SocGholish Fake Updates

GachiLoader adopts AI skill lure

Unmasking The 64-bit Variant of the Infamous Lumma Stealer

Iranian MOIS Actors & the Cyber Crime Connection

GachiLoader: Defeating Node.js Malware with API Tracing

Technical Analysis of Matanbuchus 3.0

Water APT Multi-Stage Attack Uncovered

ClickFix Gets Creative: Malware Buried in Images

Dissecting YouTube's Malware Distribution Network

Rhadamanthys 0.9.x - walk through the updates

August 2025 Infostealer Trend Report

Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66

Distribution of SmartLoader Malware via Github Repository Disguised as a Legitimate Project

MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities

June 2025 Infostealer Trend Report

May 2025 Infostealer Trend Report

Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication

JScript to PowerShell: Breaking Down a Loader Delivering XWorm and Rhadamanthys

The Wagmi Manual: Copy, Paste, and Profit

Unveiling EncryptHub: Analysis of a multi-stage malware campaign

A Deep Dive into Water Arsenal and Infrastructure

CoffeeLoader: A Brew of Stealthy Techniques

Unmasking GrassCall Campaign: The Hackers Behind Job Recruitment Cyber Scams

Unmasking GrassCall Campaign: The APT Behind Job Recruitment Cyber Scams

Security Brief: Threat Actors Take Taxes Into Account

Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation

NetSupport RAT and RMS in malicious emails

CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits

Threat actors use copyright infringement phishing lure to deploy infostealers

ClickFix tactic: The Phantom Meet

Beware: Fake Google Meet Pages Deliver Infostealers in Ongoing ClickFix Campaign

The Abuse of ITarian RMM by Dolphin Loader

RHADAMANTHYS: In-Depth Analysis of a Sophisticated Stealer Targeting Israeli Users

New Hijack Loader Variant: Uses Process Hollowing, Has Enhanced Anti-Evasion Capabilities

HijackLoader Updates