A new cybersecurity threat has emerged involving a targeted cyberespionage campaign that leverages trusted infrastructure to gain persistent access to victim systems.
Cyble Research and Intelligence Labs (CRIL) discovered this operation, which utilizes social engineering tactics and hosts its malicious payload on GitHub Releases.
The attack focuses heavily on intelligence gathering, prioritizing stealth and long-term surveillance while minimizing its operational footprint.
Infostealer Abuses GitHub Releases
The campaign begins with a phishing email that delivers a malicious LNK file disguised within a RAR archive. The threat actor uses a Russian-language humanitarian aid request form to build contextual trust with the victim.
When executed, the LNK file uses a deliberate anti-sandbox technique; it contains self-obfuscated content that is extracted and executed by PowerShell directly in memory.
This approach ensures the malware runs only if the original file is present on the disk, thereby evading automated security scanning tools.
While the infection runs silently in the background, a decoy document the humanitarian aid form is displayed to the user.
Cyble researchers have also observed a secondary lure that uses a survey link, indicating that the attackers are actively refining their delivery methods.
The malware then creates a self-contained Python environment in the user’s system folder, specifically naming it “WindowsHelper” to mimic legitimate system components and avoid requiring administrative privileges.
Once fully deployed, the implant functions as a comprehensive surveillance platform. It collects stored passwords, session cookies, and decrypts credentials from all major Chromium-based browsers and Firefox.
The malware continuously logs keystrokes, monitors real-time clipboard data, and takes automated desktop screenshots that are archived and periodically uploaded to the attacker’s server.
It also scans the victim’s directories for high-value files, specifically targeting documents, configuration files, and potential cryptocurrency private keys.
The implant can extract Telegram session data, granting the attacker full access to the victim’s account without a password.
Additionally, it can silently install legitimate remote desktop tools such as TeamViewer and AnyDesk. This allows the attacker to maintain live, interactive remote access to the compromised machine with no visible window, alerting the user.
All stolen data is transmitted to an attacker-controlled server hosted on a commercial Virtual Private Server (VPS).
The infrastructure includes a custom-built login panel that allows the threat actor to access exfiltrated data, monitor active implants, and initiate remote sessions.
| Tactic (Tactic ID) | Technique (Technique ID) | Description |
|---|---|---|
| Initial Access (TA0001) | Phishing: Spearphishing Attachment (T1566.001) | Malicious LNK file inside a RAR archive, delivered as a Russian-language humanitarian aid lure. |
| Execution (TA0002) | User Execution: Malicious File (T1204.002) | The victim must open the LNK file to trigger the infection chain. |
| Execution (TA0002) | Command and Scripting Interpreter: PowerShell (T1059.001) | PowerShell reads content from a specific offset within the LNK file and executes the obfuscated payload. |
While the exact identity of the threat actor remains inconclusive, the specific use of Russian-language lures strongly suggests the campaign targets Russian-speaking individuals or entities.
Please exercise caution with unsolicited email attachments, audit scheduled tasks, and monitor for unauthorized installations of remote access software.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
