Search: “VenomRAT”

18 stories

A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.

Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.

Palo Alto Unit 42Aug 17, 10:57 UTC · Aug 17, 2026Malware CVE-2023-40477 CVE-2023-25157

PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users

JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.

PAPERMILL delivers ISO disk images via tax-audit phishing emails that passed SPF, DKIM, and DMARC, containing a renamed Authenticode-signed Notepad++ executable and a malicious libcurl.dll that proxies curl functions while executing loader logic in DllMain. The chain uses Mark-of-the-Web bypasses, anti-sandbox sleeps, UAC elevation prompts, Registry persistence, and a Donut shellcode loader to reflectively load .NET VenomRAT v6.0.3 with HVNC and credential-stealing capability, with C2 at 154.36.188.201:4449. JUMPSEC assesses the campaign as China-nexus, financially motivated, and Silver Fox-adjacent rather than definitively Silver Fox-operated.

GBHackersupdated 12:23 UTC · 7h agofirst 09:36 UTC · 9h agoMalware in the wild 2 sources

Search: “VenomRAT”

Fake CVE-2023

PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users

ScrubCrypt used to drop VenomRAT along with many malicious plugins

Get a Loda This: LodaRAT meets new friends

Operation Endgame 3.0 Dismantles Three Major Malware Networks

Rhadamanthys infostealer operation disrupted by law enforcement

AsyncRAT seeds family of more than 30 remote access trojans

Fake Bitdefender website used to spread infostealer malware

Fake Bitdefender Site Spreads Trio of Malware Tools

Operation Endgame targets malware networks in global crackdown

Crooks use a fake antivirus site to spread Venom RAT and a mix of malware

Hackers steal hotel guests’ payment data in new AI

AsyncRAT evolves as ESET tracks its most popular malware forks

Attackers Using Obfuscation Tools to Deliver Multi

Phishing campaign impersonating Booking.com targets hospitality sector with malware

ClickFix: How to Infect Your PC in Three Easy Steps

Cybercriminals Using Powerful BatCloak Engine to Make Malware Fully Undetectable

FUD Malware obfuscation engine BatCloak continues to evolve