Security News · thehackernews.com

This Week’s Threats Include Game-Cheat Spyware, Spirals Ransomware and Chrome Sync Abuse

Jul 16, 2026 · Original article ↗

Summary

The roundup details fake-package and installer malware, a reported rapid Spirals ransomware attack, flaws added to CISA’s KEV catalog, Windows bind-link EDR bypasses, Chrome Sync stalking and phishing campaigns.

Key points

Researchers identified 11 malicious NuGet packages posing as .NET game tools that downloaded a second-stage payload named pepesoft.exe from GitHub Releases and Hugging Face.
Cisco Talos attributed a campaign targeting users in the U.S. and Europe to UAT-11795, which used ClickFix lures and trojanized installers to deploy Starland RAT and WLDR agent.
A report said an unknown attacker accessed a South Asian IT services network through an internet-facing IIS server and web shell before deploying the previously undocumented Spirals ransomware within 24 hours.
CISA added CVE-2026-46817 and CVE-2023-4346 to its Known Exploited Vulnerabilities catalog, with federal remediation deadlines of July 18 and July 29, 2026.
Bitdefender demonstrated that Windows bind-link techniques could evade EDR and built-in defenses, but require local administrator access; Microsoft assessed the findings as low severity.
Researchers found 292 fake GitHub repositories impersonating trusted vendors and distributing a one-run infostealer sharing code with BoryptGrab.
Certo described how brief physical access to a phone could let an intruder add a controlled Google account and use Chrome Sync to view the victim’s browsing data.
Other reported phishing activity included the SeasonalInvite campaign abusing commercial RMM tools and the Jalisco and OmegaLord toolkits targeting OAuth device codes and credentials.

Article Details

Event Type: Weekly cybersecurity threat roundup covering malware campaigns, ransomware, vulnerability exploitation, phishing, fraud, and law-enforcement actions.
Impact: Reported activity included a South Asian IT services network encrypted less than 24 hours after an initial breach; malware campaigns targeting credentials, browser data, cryptocurrency wallets, and SaaS data; and surveillance enabled through Chrome Sync abuse. CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog, with remediation deadlines for federal agencies. The article also reports disrupted fraud operations and an indictment alleging cybercrimes against U.S. victims.

MITRE ATT&CK

T1003.002 · Security Account ManagerThe Spirals attacker reportedly dumped the Security Account Manager hive.T1041 · Exfiltration Over C2 ChannelAn infostealer reportedly packaged stolen data into a ZIP archive and exfiltrated it to a command-and-control server.T1059.001 · PowerShellA PowerShell stager was used to decrypt and run WLDR agent.T1105 · Ingress Tool TransferFirst-stage downloaders fetched second-stage payloads, and ClickFix-delivered scripts downloaded trojanized installers.T1113 · Screen CaptureThe game-automation application’s Telegram bot commands could send screenshots to a configured chat.T1204.002 · Malicious FileTrojanized installers and downloaded payloads were run as part of the reported infection chain.T1219 · Remote Access ToolsThe SeasonalInvite phishing campaign abused commercial remote monitoring and management tools.T1486 · Data Encrypted for ImpactSpirals ransomware encrypted machines across an IT services network.T1539 · Steal Web Session CookieVidar was reported to steal browser session cookies.T1555.003 · Credentials from Web BrowsersReported infostealer activity targeted browser credentials.T1562.001 · Disable or Modify ToolsThe attacker in the Spirals incident reportedly uninstalled endpoint security software.T1566 · PhishingPhishing emails and social-engineering lures were reported in campaigns delivering RMM tools, scripts, or malware.T1569.002 · Service ExecutionPsExec was used to deploy ransomware across the network.

CVE

CVE-2023-4346CISA added Oracle E-Business Suite CVE-2026-46817 and KNX CVE-2023-4346 to its KEV catalog.CVE-2026-35273Proton66 OOO was linked to active exploitation of CVE-2026-35273, a critical Oracle PeopleSoft zero-day attributed to the ShinyHunters group, with threat activity enabling infrastructure directly traceable to this CVE-2026-46817CISA added Oracle E-Business Suite CVE-2026-46817 and KNX CVE-2023-4346 to its KEV catalog.

People

Martin ZugecBitdefender’s Martin Zugec described how Windows bind links could be misused to evade EDR sensors and built-in defenses.

Threat Actors

Alexander Alexandrovich VolosovikA U.S. indictment charged Volosovik with a role in cybercrimes against U.S. victims; this is an allegation reported by the article.Cloud Atlas APTHunt.io reported observing Cloud Atlas APT infrastructure across multiple Eastern European providers.Kirill Andreevich ZatolokinA U.S. indictment charged Zatolokin with a role in cybercrimes against U.S. victims; this is an allegation reported by the article.ShinyHuntersThe article attributes the active exploitation of CVE-2026-35273 to ShinyHunters.UAT-11795Cisco Talos reported that this financially motivated adversary conducted a campaign using trojanized installers to deliver Starland RAT and WLDR agent, among other malware.Yulia Vladimirovna PankovaA U.S. indictment charged Pankova with a role in cybercrimes against U.S. victims; this is an allegation reported by the article.

Malware

BoryptGrabvendors, including Arctic Wolf, to distribute a Windows infostealer that shares the same codebase as BoryptGrab.CastleStealerAlternatively, UAT-11795 has been linked to the deployment of CastleStealer and Remcos RAT.ClickLock StealerIn recent weeks, ClickFix has also served as a conduit for TELEPUZ, a modular malware, and ClickLock Stealer, a macOS-focused information and cryptocurrency wallet stealer targeting users in Europe, North America, and OmegaLordnew AI-powered device code phishing toolkit called Jalisco, along with a credential harvester codenamed OmegaLord that captures phone numbers alongside passwords to intercept multi-factor authentication (MFA) codes.Remcos RATAlternatively, UAT-11795 has been linked to the deployment of CastleStealer and Remcos RAT.SpiralsThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.Starland RATThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.TELEPUZIn recent weeks, ClickFix has also served as a conduit for TELEPUZ, a modular malware, and ClickLock Stealer, a macOS-focused information and cryptocurrency wallet stealer targeting users in Europe, North America, and VidarA financially motivated campaign has been observed delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide.WLDR agentThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.

Vendors

ConnectWiseThe attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr.GitHubThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.Google“The recovered payloads use downloader-supplied AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware, and honor a remote HWID/UUID ban-list,” Socket said.Hugging FaceThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.KaseyaThe attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr.KNX AssociationSuite, and CVE-2023-4346, an overly restrictive account lockout mechanism vulnerability in KNX Association KNX Protocol Connection Authorization Option 1, to its Known Exploited Vulnerabilities (KEV) catalog,LogMeIn, Inc.The attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr.Media LandThe charges are against Alexander Alexandrovich Volosovik, Kirill Andreevich Zatolokin, Yulia Vladimirovna Pankova, Media Land LLC, and ML.Cloud LLC.MicrosoftMicrosoft has assessed the findings as low severity because it requires administrator access.ML.Cloud LLCThe charges are against Alexander Alexandrovich Volosovik, Kirill Andreevich Zatolokin, Yulia Vladimirovna Pankova, Media Land LLC, and ML.Cloud LLC.OracleCISA added Oracle E-Business Suite CVE-2026-46817 and KNX CVE-2023-4346 to its KEV catalog.

Products

ConnectWise ScreenConnectThe attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr.Entra IDaccount, attackers establish persistence by pairing multiple attacker-controlled devices to the victim’s Entra ID tenant, then move quickly to exfiltrate sensitive data from software-as-a-service (SaaS) platforms for GitHubThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.Google ChromeThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.Google Sheets“The recovered payloads use downloader-supplied AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware, and honor a remote HWID/UUID ban-list,” Socket said.Hugging FaceThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.KaseyaThe attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr.KNX Protocol Connection Authorization Option 1an overly restrictive account lockout mechanism vulnerability in KNX Association KNX Protocol Connection Authorization Option 1, to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to LogMeIn ResolveThe attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr.Microsoft 365 Apps for Enterprise“Once inside a compromised Microsoft 365 account, attackers establish persistence by pairing multiple attacker-controlled devices to the victim’s Entra ID tenant, then move quickly to exfiltrate sensitive data from Microsoft WindowsWindows bind links evade EDR NuGetThe activity spanned fake NuGet packages, Starland RAT, WLDR agent, Spirals ransomware, Chrome Sync abuse, and multiple abuse campaigns tied to GitHub, GitHub Releases, and Hugging Face.O&O SyspectrThe attacks involve the abuse of ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr.Oracle E-Business SuiteCISA added Oracle E-Business Suite CVE-2026-46817 and KNX CVE-2023-4346 to its KEV catalog.Oracle PeopleSoftProton66 OOO was linked to active exploitation of CVE-2026-35273, a critical Oracle PeopleSoft zero-day attributed to the ShinyHunters group, with threat activity enabling infrastructure directly traceable to this

Tools

curlHTA scripts, which then download and run trojanized installers to deliver Starland RAT, which then uses “curl.exe” to execute a PowerShell stager for decrypting and running WLDR agent.EvilTokensdefeating the time-based controls defenders rely on and pairing naturally with AI-powered kits like ‘EvilTokens,’” ReliaQuest said.Factory-v3XMRig mines Monero cryptocurrency.” The loader binaries use the Factory-v3 framework, which refers to a malware-as-a-service (MaaS0 builder used for different families of stealer malware.JaliscoCybersecurity researchers have identified a new AI-powered device code phishing toolkit called Jalisco, along with a credential harvester codenamed OmegaLord that captures phone numbers alongside passwords to intercept PsExec(SAM) hive, and set up covert remote access prior to deploying the payload across the network using PsExec.XMRigA financially motivated campaign has been observed delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide.

Countries

AustraliaThe defendants and the companies were sanctioned by the U.S., the U.K., and Australia in November 2025.GermanyThe majority of the infections are in the U.S., with fewer potential impacts recorded in Germany, Romania, and Venezuela.NetherlandsSecurity Agency (NSA), Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), Netherlands’ National Cyber Security Centre (NCSC-NL), and United Kingdom’s National Cyber Security Centre PanamaFour people have been apprehended in connection with the operation: two in Portugal, one in Spain, and one in Panama.PortugalFour people have been apprehended in connection with the operation: two in Portugal, one in Spain, and one in Panama.RomaniaThe majority of the infections are in the U.S., with fewer potential impacts recorded in Germany, Romania, and Venezuela.Russia“Stolen data is packaged into a ZIP archive and exfiltrated to a C2 with an IP residing in Russia, on a hosting provider repeatedly associated with malware operations.” The malware does not set up persistence on the SpainFour people have been apprehended in connection with the operation: two in Portugal, one in Spain, and one in Panama.United KingdomThe defendants and the companies were sanctioned by the U.S., the U.K., and Australia in November 2025.United StatesUAT-11795, a sophisticated, Russian-speaking, financially motivated adversary, has been observed conducting a malicious campaign targeting users in the U.S.VenezuelaThe majority of the infections are in the U.S., with fewer potential impacts recorded in Germany, Romania, and Venezuela.

Industries

CybersecurityCybersecurity researchers 11 malicious NuGet packages published as .NET command-line tools that present themselves as game utilities, bots, and “panels,” each of which act as a first-stage downloader responsible for IT servicesSpirals ransomware encrypted a South Asia IT services network within 24 hours.

Related Articles