VLC and VMware binaries side-load malware targeting Brazil and Portugal
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
62
Malware
Overlord RAT
- Mentions · 7d2
- Mentions · 30d6
- All mentions7
- First seenSep 3, 2026
- Last mentioned4d ago
Timeline
7 articles · newest firstOverlord and Lampion campaigns hide malware with Windows tools
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
58
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Malicious npm package imgdecode, tied to MALFEX, loads a DLL that downloads and injects shellcode.
74
MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers
MALFEX npm packages hide Windows malware in fake PNG files, delivering Overlord RAT and the movinlike stealer.
72
Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
The MALFEX npm campaign ships Overlord RAT and movinlike to steal browser passwords, Discord tokens, and crypto wallets.
71
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Checkmarx says a long-running npm campaign passed 40,000 downloads of packages dropping Overlord RAT and stealers.
63
Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates
ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.
28
Appears with
- movinlikemalware · 4
- npmproduct · 4
- Checkmarxorganization · 4
- npmvendor · 2
- MALFEXthreat actor · 2
- WatchGuardorganization · 2
- Lampionmalware · 2
- GitHuborganization · 2
- MALFEXmalware · 2
- Donutmalware · 2
- VLC Media Playerproduct · 1
- Telegram Desktopproduct · 1
- Discordproduct · 1
- LogMeIn Rescueproduct · 1
- ANY.RUN TI Lookupproduct · 1
- imgdecodemalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.