ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories

A lot of this week’s trouble starts with something that looks close enough. A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation.

Old bugs are back, weak defaults are earning their keep, and some attack paths are so plain they barely feel like research. Here’s the mess. Cybersecurity researchers 11 malicious NuGet packages published as .

NET command-line tools that present themselves as game utilities, bots, and "panels," each of which act as a first-stage downloader responsible for fetching and executing a second-stage Python payload named "pepesoft.

exe" from GitHub Releases and Hugging Face paths under the username "pepegit666," along with a dormant BitTorrent fallback mechanism built into it.

"The recovered payloads use downloader-supplied AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware, and honor a remote HWID/UUID ban-list," Socket said .

"In the three direct-bytecode payloads, the larger game-automation application also exposes Telegram bot commands that can send screenshots back to the configured chat."

UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary, has been observed conducting a malicious campaign targeting users in the U. S. and Europe since at least June 2025.

The activity delivers a Python-based remote access tool (RAT) dubbed Starland RAT and a command-and-control (C2) memory implant known as WLDR agent using trojanized installer lures for software like developer tooling, IT administration utilities, enterprise collaboration platforms, and consumer gaming applications (e.

g. , MobaXterm, WebEx, Zoom, DBeaver, and FaceIT). "The WLDR agent is a sophisticated PowerShell-based C2 memory implant that features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads," Cisco Talos said .

Alternatively, UAT-11795 has been linked to the deployment of CastleStealer and Remcos RAT.

The malware is designed to target victims' credentials and cryptocurrency wallet assets, harvest Active Directory information, and establish a persistent connection to the victims' machines from the C2 server, likely with an aim to deliver and execute further payloads. The majority of the infections are in the U. S.

, with fewer potential impacts recorded in Germany, Romania, and Venezuela. The attack chain makes use of ClickFix lures to distribute HTA scripts, which then download and run trojanized installers to deliver Starland RAT, which then uses "curl. exe" to execute a PowerShell stager for decrypting and running WLDR agent.

In recent weeks, ClickFix has also served as a conduit for TELEPUZ , a modular malware, and ClickLock Stealer , a macOS-focused information and cryptocurrency wallet stealer targeting users in Europe, North America, and MEA.

"ClickLock Stealer targets data from 8 browsers, 31 crypto wallet browser extensions, 7 password manager extensions, 8 desktop wallet applications, extracts blockchain addresses across 6 chains, macOS Keychain, shell history, and FTP credentials," Group-IB said.

An IT services company in South Asia was targeted by a previously undocumented ransomware family called Spirals in June 2026. "The Rust-based payload is either a new ransomware threat or one purpose-built for this attack," Broadcom's Symantec and Carbon Black Threat Hunter Team said .

"Less than 24 hours after the initial breach, the ransomware payload was being pushed to machines on the network." The attacker is said to have obtained initial access by compromising an internet-facing IIS web server and uploading an web shell.

Over the next three hours, they established persistent access, conducted reconnaissance, uninstalled endpoint security software, dumped the Security Account Manager (SAM) hive, and set up covert remote access prior to deploying the payload across the network using PsExec.

The ransom note seeks to apply pressure by threatening to publish stolen data after six days if a ransom is not paid and directs victims to a Tor portal for negotiations. The actor behind the attack remains unknown. The U. S.

Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-46817, an improper privilege management vulnerability in Oracle E-Business Suite, and CVE-2023-4346 , an overly restrictive account lockout mechanism vulnerability in KNX Association KNX Protocol Connection Authorization Option 1, to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring federal agencies to apply the fixes by July 18 and 29, 2026, respectively.

Reports about active exploitation of CVE-2026-46817 emerged late last month. It's currently not known how the KNX Protocol flaw is being abused and by whom.

Authorities from the Netherlands have arrested a 46-year-old man with Israeli and Polish citizenship, who is alleged to be behind an international criminal organization with more than 700 employees who were employed at about 20 fraudulent call centers.

These individuals posed as financial advisors to conduct investment fraud. "By maintaining regular contact, sometimes over a period of months, these scammers build a bond of trust with their victims," the Dutch police said . "The initial deposit is always a relatively small amount that yields an immediate profit.

The online platform where victims can view their investments is indistinguishable from the real thing, yet in reality, no actual investments are being made. Scammers use a friendly approach and cunning tactics to manipulate victims into depositing ever-larger sums.

The money – often cryptocurrency – that victims believe they are investing ends up in the scammers' pockets." The operation has also led to the arrest of four "financial advisors."

Spanish National Police have disrupted a cybercrime network accused of stealing and laundering about €140 million through fake investment platforms, CEO fraud, invoice fraud, and adversary-in-the-middle attacks across Europe.

Four people have been apprehended in connection with the operation: two in Portugal, one in Spain, and one in Panama.

"The suspects established and managed a network of over 800 bank accounts to receive substantial sums of illicit money swindled from numerous victims; these funds were immediately dispersed and concealed across another network of accounts, creating a chain of transactions that safeguarded the criminal proceeds and allowed the vast amounts of defrauded money to be hidden and laundered through 'money mule' accounts in third countries," police said .

"To create the complex web of accounts used for money laundering, the group utilized an extensive network of money mules – European citizens who had arrived in Spain from other countries – to set up companies and subsequently open bank accounts across Spanish territory."

Bitdefender Labs has demonstrated three attack techniques in which Windows' bind links can be misused to evade endpoint detection and response (EDR) products.

"Windows includes a file-system virtualization feature that can redirect one local path to another without modifying the original file or leaving a persistent filesystem artifact," Bitdefender's Martin Zugec said . "It is implemented by bindflt.

sys, the Bind Filter minifilter driver, and used legitimately by Store apps, Windows Sandbox, and Windows containers." The techniques can be leveraged by an attacker running as a local administrator to bypass EDR sensors and built-in Windows defenses such as AMSI and AppLocker.

The techniques include: File-Binding, Process-Binding, and Silo-Binding, each of which shadow a trusted file or DLL path, a trusted executable path, and a user-defined Windows silo. Microsoft has assessed the findings as low severity because it requires administrator access.

A financially-motivated threat actor has set up more than 290 fake GitHub repositories impersonating trusted s