Join Cyderes as a Principal Consultant in IGA, guiding IAM solutions. Seeking experts in cybersecurity with a strong consulting background.

isecjobs.com will become foo🦍 - visit foorilla.com!

The Howler Cell Threat Research Team has uncovered an active and highly sophisticated stealer campaign that has been operating since at least April 2025 and remains ongoing.

Researchers at cybersecurity vendor Cyderes are warning about the threat, which has been hiding inside cracked games and modified game installers for franchises including Far Cry, Need for Speed, FIFA, and Assassin’s Creed.

Cybersecurity researchers have disclosed details of a new campaign that has used cracked software distribution sites as a distribution vector for a new version of a modular and stealthy loader known as CountLoader. The campaign "uses CountLoader as the initial tool in a multistage attack for access, evasion, and delivery of additional malware families," Cyderes Howler Cell Threat Intelligence

Cybersecurity researchers have disclosed details of a new campaign that has used cracked software distribution sites as a distribution vector for a new version of a modular and stealthy loader known as CountLoader. The campaign "uses CountLoader as the initial tool in a multistage attack for access, evasion, and delivery of additional malware families," Cyderes Howler Cell Threat Intelligence

Today we are joined by Brian Hussey, SVP of Howler Cell Threat Services at Cyderes, discussing their work on "Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer." Howler Cell identified an SEO poisoning campaign targeting people searching for Claude Code installation guides, using a fake Anthropic page and a ClickFix lure to trick victims into running a malicious MSHTA command. The attack uses a six-stage, largely fileless chain that employs an MP3/HTA polyglot, PowerShell obfuscation, AMSI bypasses, per-victim infrastructure, and in-memory execution to evade detection. The final payload is a .NET infostealer that steals credentials, while Anthropic and the legitimate Claude Code installation process were not compromised. The research and executive brief can be found here: Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer

At a glance Actor / group DoNot (APT-C-35); assessed by multiple vendors as India-aligned Activity type Targeted cyber-espionage via spear-phishing and RTF template injection Targets / victims Bangladesh military and defence personnel Scale Active campaign; live C2 serving second-stage modules (victim count undisclosed) Status Ongoing; no arrests; infrastructure still live during analysis Source Cyderes Howler Cell TL;DR Researchers at Cyderes uncovered a live DoNot…

Cybercriminals are exploiting India’s tax filing season with a new malware campaign that refuses to put all its eggs in one basket. Researchers at Cyderes have uncovered a sophisticated phishing operation that poses as the Indian Tax Department to deliver two remote access trojans (RATs) through a multi-stage infection chain, giving attackers persistent access to compromised systems. Indians receive fake tax assessment emails that pressure them into downloading what appears to be an official ITR utility. But the convincing government branding hides a carefully engineered infection sequence that abuses legitimate Windows binaries, DLL side-loading, in-memory execution, and process injection to gain persistent access. According to Cyderes, the operation deploys a Gh0st RAT derivative and a .NET-based implant related to the QuasarRAT/AsyncRAT family, each communicating with separate command-and-control (C2) servers. “The dual-implant design gives the attacker redundant access even if one channel is blocked or detected,” Cyderes researchers said in a blog post. ## A stealthy, multi-stage infection chain To avoid detection, the campaign layers its execution chain, rather than dropping malware immediately after initial access. Once the victims are lured into downloading and opening the archives posing as legitimate Income Tax Department utilities, trusted Windows executables are abused to load malicious DLLs. This allows the malware to borrow the legitimacy of signed binaries while sidestepping security controls. “The infection begins with ‘COU_ITR-1_to_4_AY2026-27.exe’, a legitimate and digitally signed binary that the attacker repurposes as a launcher,” the researchers said, adding that it is a known technique where an attacker “places a malicious library in a path the trusted binary will check first, giving the malware a clean entry point.” The campaign then runs its subsequent infection stages, which employ multiple defense-evasion techniques, including anti-analysis checks, AMSI patching, encrypted in-memory execution of .NET assemblies, and session-aware process injection into svchost.exe. The multiple attack stages include DLL sideloading, privilege checking to ensure the attack process is running with admin rights, and session-aware payload injection. ## Dual implants for operational resilience The campaign was particularly flagged for its deliberate use of two distinct RAT families rather than relying on a single backdoor. While one implant is based on the long-running Gh0st RAT lineage, the second belongs to the QuasarRAT/AsyncRAT ecosystem. Both provide remote administration capabilities, allowing attackers to execute commands, collect data, deploy additional payloads, and maintain long-term access to infected endpoints. Each of these RATs communicates with a dedicated command-and-control (c2) infrastructure, likely to survive detection and blocking of either during incident response. Cyderes recommended focusing on behavioral detections rather than relying solely on EDR signatures, as the campaign abuses trusted Windows components and in-memory execution. Key indicators include DLL sideloading, unexpected service creation, AMSI tampering, native processes hosting the .NET runtime, and process injection into svchost.exe. The disclosure also provided a detailed set of IOCs, including file hashes, malicious domains, C2 infrastructure, and host artifacts associated with both RAT families.

Pesquisadores da empresa de segurança Cyderes identificaram uma campanha ativa de roubo de credenciais que usa o nome do Claude Code, ferramenta de programação por inteligência artificial da Anthropic, para enganar usuários sem experiência técnica. O ataque começa com SEO poisoning, técnica que manipula resultados de busca para colocar um site falso no topo do Google quando alguém pesquisa como instalar o programa. A página imita o visual oficial da Anthropic e instrui a vítima a abrir a janela Executar do Windows e colar um comando malicioso, apresentado como etapa normal de instalação. Ao fazer isso, o computador baixa um arquivo disfarçado de MP3 que carrega um script oculto. A partir daí, o ataque desativa o verificador de scripts do Windows, baixa um segundo arquivo diretamente na memória do computador e instala um programa que rouba senhas salvas nos navegadores, enviando tudo para servidores em infraestrutura russa.