VLC and VMware binaries side-load malware targeting Brazil and Portugal
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
1
Stories per day · 30 days
3 RSS
Relatedclickfix4romulus4siemens4lampion2overlord-rat2banking-malware1c21cwe-4271legionloader1phishing1powershell1software-center1vbscript1vlc1vmware1
22 stories, newest first · one card per story
Stories tagged #dll-side-loading
Overlord and Lampion campaigns hide malware with Windows tools
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
1
Siemens Software Center DLL side-loading flaw exploited before 4.0.9.8
Attackers shipped signed Software Center 3.5.8.7 with malicious DLLs; every build before 4.0.9.8 is affected.
2
Siemens Software Center DLL flaw exploited in ClickFix attacks
CVE-2026-110936, fixed in 4.0.9.8, was used to side-load malware beside an unmodified signed executable in the Romulus campaign.
3
Siemens Software Center DLL side-loading flaw exploited in ClickFix campaign
CVE-2026-110936 (CVSS 8.4) is fixed in Software Center 4.0.9.8; Siemens lists startup, file and IP indicators.
Siemens Software Center DLL flaw exploited in Romulus ClickFix attacks
CVE-2026-110936 let attackers side-load DLLs beside a signed Software Center build; version 4.0.9.8 fixes it.
7
Microsoft Warns NeedyMantis Malware Enables Persistent Network Access
Microsoft warns China-linked NeedyMantis malware maintains persistent access in telecom, university, and government networks.
1
Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection
Sauron Loader, sold to Russian-speaking criminals, uses DLL side-loading and memory decryption against German organizations.
13
New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools
A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.
3
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
Fake LastPass Authenticator GitHub repos spread new Rapuncel infostealer alongside a Microsoft-signed kernel driver that kills 145 antivirus and EDR products.
2
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.
3
Chinese hackers use SparroWocky malware in govt espionage attacks
ESET reports China-linked FamousSparrow deployed a new modular backdoor, SparroWocky, in year-long espionage attacks on Latin American government organizations.
2
Fake AI trading agent steals crypto wallet passwords
Fake AI crypto trading agent sites deliver Needle Stealer, which replaces browser wallet extensions to steal wallet passwords, HP reports.
2
KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions
Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.
1
BambooToken malware controls Windows and Linux systems via MQTT
Lumen Black Lotus Labs exposes BambooToken, a China-aligned malware framework using MQTT C2 to backdoor Windows and Linux systems at roughly a dozen enterprises.
2
New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
A new Windows backdoor dubbed SLEEPWALKER hides as ESET Management Agent's dpapi.dll, waits for a crafted network packet, then executes custom 23-instruction bytecode.
From 88 lines to 1: Detecting DLL hijacking with Elastic Defend
Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.
1
Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools
Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.
1
Silver Fox Targets Japanese Manufacturer with 3
Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.
Cybercriminals Turn GTA VI Leaks Into Malware Bait
Attackers spread fake 113GB GTA VI builds whose 50KB payload whitelists the entire C: drive in Windows Defender, alongside credential phishing and infostealer campaigns.
1
Tracking OceanLotus’ new Downloader, KerrDown
Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.
2
Malspam Targeting Brazil Continues to Evolve
Brazilian malspam campaigns continue evolving, abusing Google URL shortener and Dropbox and using Squiblydoo plus DLL side-loading to deploy likely infostealing botnet malware.
2