Rhysida ransomware gang has been using code-signing certificates to validate their malware campaigns repeatedly. Here's the latest.

A sophisticated malware loader known as OysterLoader has emerged as a significant threat in the cybersecurity landscape, employing multiple layers of obfuscation to evade detection and deliver dangerous payloads. First identified in June 2024 by Rapid7, this C++ malware is distributed primarily through fake websites that impersonate legitimate software applications such as PuTTy, WinSCP, Google Authenticator, and various AI tools . The malware masquerades as Microsoft Installer (MSI) files, often digitally signed to appear legitimate, making it particularly deceptive to unsuspecting users. OysterLoader operates through a complex four-stage infection chain that begins with a TextShell packer, progresses through custom shellcode execution, and ultimately delivers the core malicious payload. The loader has been primarily associated with Rhysida ransomware campaigns, though security researchers have also observed it distributing commodity malware like Vidar, one of the most widespread infostealers as of January 2026. The connection to the Rhysida ransomware group, which is closely linked to the WIZARD SPIDER threat actor nebula, highlights the severity of this threat. Sekoia analysts identified that OysterLoader maintains a two-tiered command and control infrastructure, with delivery servers handling initial connections and final C2 servers managing victim interactions. The malware exhibits advanced anti-analysis capabilities, including API hammering, dynamic API resolution through custom hashing algorithms, and timing-based sandbox detection. Its developers have continuously evolved the malware’s code, updating communication protocols and obfuscation techniques to maintain effectiveness against security solutions . Advanced Infection Mechanism and Steganography Techniques The infection process demonstrates remarkable technical sophistication in how OysterLoader conceals and deploys its malicious components. After initial environment checks that verify the infected system has at least 60 running processes, the malware establishes communication with command and control servers over HTTPS. During this phase, it employs steganography to hide the next-stage payload within icon image files, disguising malicious code as legitimate visual content. OysterLoader stage 2 shellcode graph overview (Source – Sekoia) The malware uses RC4 encryption with a hardcoded key to protect the embedded payload within these image files. This payload is hidden after a specific marker pattern labeled “endico,” making detection through conventional security tools extremely challenging. Once decrypted, the payload is written as a DLL file to the user’s AppData directory and executed through scheduled tasks that run every 13 minutes, ensuring persistent access to compromised systems. The malware communicates using custom JSON encoding with a non-standard Base64 alphabet and random shift values, making network traffic analysis particularly difficult for security teams monitoring infected environments. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post OysterLoader Multi‑Stage Evasion Loader Uncovered with Advanced Obfuscation and Rhysida Ransomware Links appeared first on Cyber Security News .

Hackers are placing sponsored search ads for Microsoft Teams that lead to malicious clones of the installer, infecting users’ machines with ransomware like Rhysida’s OysterLoader.

Introduction Cybersecurity experts are raising alarms over a new wave of malicious advertising campaigns that are putting millions of users at risk. Since June 2025, the notorious Rhysida ransomware gang has been leveraging fake advertisements for widely used software tools like PuTTy, Microsoft Teams, and Zoom to distribute a dangerous malware known as OysterLoader. By exploiting trust in familiar brands and sophisticated technical methods, the gang is widening its reach, targeting both individuals and enterprises with unprecedented precision.

OysterLoader spreads via fake MSI sites, using obfuscation and staged payloads to evade detection and infect victims.

OysterLoader, also tracked as Broomstick and CleanUp, is a multi‑stage loader malware written in C++ and actively leveraged in campaigns linked to the Rhysida ransomware.

The campaign, which has been running since June 2025, is orchestrated by the notorious Rhysida ransomware gang

Hackers are placing sponsored search ads for Microsoft Teams that lead to malicious clones of the installer, infecting users’ machines with ransomware like Rhysida’s OysterLoader.

Curate Feeds | Make Collections | Customize Email Briefs