Campanhas CountLoader e GachiLoader exploram 39 contas comprometidas do YouTube e sites de pirataria, implementando técnicas de evasão que burlam todos os antivírus tradicionais

Cybersecurity researchers have discovered a new malware loader codenamed CountLoader that has been put to use by Russian ransomware gangs to deliver post-exploitation tools like Cobalt Strike and AdaptixC2, and a remote access trojan known as PureHVNC RAT. "CountLoader is being used either as part of an Initial Access Broker's (IAB) toolset or by a ransomware affiliate with ties to the LockBit, Black Basta, and Qilin ransomware groups," Silent Push said in an analysis.

A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]

Cybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control of victims' systems. The Minecraft-focused malware-as-a-service (MaaS) campaign has been codenamed Weedhack by McAfee Labs, stating the activity has been active since January 2026 and impersonates Minecraft clients and mods to infect users. In all, 3820

Cybersecurity researchers have disclosed details of a new campaign that has used cracked software distribution sites as a distribution vector for a new version of a modular and stealthy loader known as CountLoader. The campaign "uses CountLoader as the initial tool in a multistage attack for access, evasion, and delivery of additional malware families," Cyderes Howler Cell Threat Intelligence

A phishing campaign uses malicious SVG files to target Ukraine, delivering Amatera Stealer and PureMiner malware in a fileless attack chain.

Researchers have discovered CountLoader, a new malware loader allegedly used by LockBit, BlackBasta, and Qilin ransomware groups to initiate attacks.

Threat actors are abusing cracked software and YouTube videos to distribute CountLoader and GachiLoader malware to unsuspecting users.

Weedhack malware targets Minecraft players via YouTube and SEO poisoning since Jan 2026, enabling credential theft and remote access.

SVG phishing emails drop CountLoader to deploy Amatera Stealer and PureMiner in Ukrainian government attack.

Silent Push discovered a new malware loader, we're naming “CountLoader.” The threat is served in .NET, PowerShell, and JScript versions.

Servicio ruso DOUBLECUP usa ataques ClickFix para esconder malware en caché del navegador. Entrega DeviceManager RAT y CountLoader a Windows y macOS desde junio

DOUBLECUP hides malware stages in cached PNG files, then uses ClickFix commands to deliver CountLoader variants and the DeviceManager RAT in memory.

A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices...

 Cybersecurity analysts have uncovered a new malware campaign that relies on cracked software download platforms to distribute an updated variant of a stealthy and modular loader known as CountLoader. According to researchers from the Cyderes Howler Cell Threat Intelligence team, the operation uses CountLoader as the entry point in a layered attack designed to establish access, evade defenses, and deploy additional malicious payloads.  CountLoader has been observed in real-world attacks since at least June 2025 and was previously analyzed by Fortinet and Silent Push. Earlier investigations documented its role in delivering widely used malicious tools such as Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and cryptomining malware. The latest iteration demonstrates further refinement, with attackers leveraging familiar piracy tactics to lure victims.  The infection process begins when users attempt to download unauthorized copies of legitimate software, including productivity applications. Victims are redirected to file-hosting platforms where they retrieve a compressed archive containing a password-protected file and a document that supplies the password. Once extracted, the archive reveals a renamed but legitimate Python interpreter configured to run malicious commands. This component uses the Windows utility mshta.exe to fetch the latest version of CountLoader from a remote server.   To maintain long-term access, the malware establishes persistence through a scheduled task designed to resemble a legitimate Google system process. This task is set to execute every 30 minutes over an extended period and relies on mshta.exe to communicate with fallback domains. CountLoader also checks for the presence of endpoint protection software, specifically CrowdStrike Falcon, adjusting its execution method to reduce the risk of detection if security tools are identified.  Once active, CountLoader profiles the infected system and retrieves follow-on payloads. The newest version introduces additional capabilities, including spreading through removable USB drives and executing malicious code entirely in memory using mshta.exe or PowerShell. These enhancements allow attackers to minimize their on-disk footprint while increasing lateral movement opportunities. In incidents examined by Cyderes, the final payload delivered was ACR Stealer, a data-harvesting malware designed to extract sensitive information from compromised machines.  Researchers noted that the campaign reflects a broader shift toward fileless execution and the abuse of trusted, signed binaries. This approach complicates detection and underscores the need for layered defenses and proactive threat monitoring as malware loaders continue to evolve.   Alongside this activity, Check Point researchers revealed details of another emerging loader named GachiLoader, a heavily obfuscated JavaScript-based malware written in Node.js. This threat is distributed through the so-called YouTube Ghost Network, which consists of hijacked YouTube accounts used to promote malicious downloads. The campaign has been linked to dozens of compromised accounts and hundreds of thousands of video views before takedowns occurred.  In some cases, GachiLoader has been used to deploy second-stage malware through advanced techniques involving Portable Executable injection and Vectored Exception Handling. The loader performs multiple anti-analysis checks, attempts to gain elevated privileges, and disables key Microsoft Defender components to avoid detection. Security experts say the sophistication displayed in these campaigns highlights the growing technical expertise of threat actors and reinforces the importance of continuously adapting defensive strategies.

DOUBLECUP is a new Russian loader-as-a-service that uses ClickFix lures and PNG steganography to hide code in browser cache and deliver CountLoader plus the DeviceManager RAT. SOCRadar says the service has been active since early June 2026, with campaigns impersonating NetSuite, Odoo, HubSpot, and Salesforce to trick victims into running malicious commands. #DOUBLECUP #CountLoader #DeviceManager #SOCRadar

Bitdefender detailed how attackers abused Microsoft’s legacy MSHTA tool to deliver CountLoader, which deployed LummaStealer and Amatera in multiple campaigns. The research also mapped 120 network IoCs and expanded the investigation to uncover related domains, IPs, typosquatting groups, and other artifacts tied to the ClickFix attack. #MSHTA #CountLoader #LummaStealer #Amatera #ClickFix

Researchers uncovered Weedhack, a Minecraft-themed malware-as-a-service campaign spread through YouTube and SEO poisoning that uses malicious JAR files, EtherHiding, and a multi-stage infection chain to steal data and enable remote control of victims’ systems. McAfee Labs also reported related campaigns including CountLoader infections and a pirated-content operation delivering SilentCryptoMiner, with #Weedhack...

Bitdefender found that attackers are still abusing MSHTA, a legacy Windows utility, to run multi-stage attack chains that deliver malware such as LummaStealer, Amatera, ClipBanker, PurpleFox, and loaders like CountLoader and Emmenhtal Loader. The campaigns rely on social engineering, fake software downloads, ClickFix-style lures, and hidden PowerShell/HTA execution to steal data,...