Daniel Stepanic

Malwarez at @elasticseclabs | Macrodata Refinement

[Daniel Stepanic @DanielStepanic]

Our team revisited #BLISTER, a stealthy loader recently tied to #LockBit and #SocGholish. We go through it's different capabilities, and released config extractor.

Blog🔗: https://t.co/HzGszV8eF4

Config extractor 🧰: https://t.co/eMOznDWzqW

[Elastic Security Labs @elasticseclabs]

Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

You can still focus on detection coverage today.

Security Labs writeup (coverage + guidance): https://t.co/aBB6g7gCZ5

Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.

• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root

The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.

We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.

The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.

(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)

Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.

Guidance + every rule link below.

[Jia Yu Chan @k33b0i]

FWIW we notified the event organizers before it took place. Not sure if a vetting process is feasible with the amount of events going on. But for future event-goers, please be mindful of what you run on your computer.
For anyone interested in a deep dive: https://t.co/PqChPru21l.

[Elastic Security Labs @elasticseclabs]

571 IIS servers hijacked using machine keys from public docs.

@soolidsnakee and @k33b0i break down REF3927 at @virusbtn VB2026
• Today, 15:00 CEST in the Green room.

Talk abstract and kill chain outline: https://t.co/HqODWpz28b
Full blog: https://t.co/3XYkOKR4J5

[Elastic Security Labs @elasticseclabs]

We identified a malicious npm package, apexacc/cli, which led us to an operation posing as a Web3 accelerator.

Read more about REF8801 by @k33b0i and @DanielStepanic : https://t.co/QPBorc9VJg

The fake accelerator spent months courting crypto founders with free Claude and Gemini credits.

Our supply-chain monitor caught the package. It was malicious from its first published version.

The 2 Apex packages we examined, and what they deliver:
• apexacc/cli: redirects OpenRouter-labeled model requests to an attacker-controlled API
• apexacc/audit: MCP server whose 18 tools return fabricated findings
• macOS payload: CloudSyncD backdoor
• Windows payload: infostealer that exfiltrates to Telegram

We asked the operation's scoring tool to rate a project that doesn't exist. It scored 51 in every category, and said its AI scorer was down.

[Elastic Security Labs @elasticseclabs]

KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users.

New research from Elastic Security Labs (REF9334): https://t.co/0QDgJEmYho by @cyril_t_f and @andythevariable

The infection chain combines JavaScript loaders, an optional PE injector, and a custom C++ installer. The installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration.

KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction.

The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on.

Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP.

Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign.

The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.

[Daniel Stepanic @DanielStepanic]

Our team recently did a full teardown on #RevStealer. The malware is full of features and super interesting, unlike a lot of AI-generated stuff we are seeing nowadays.

Blog: https://t.co/TDjss9e38a

Whitepaper: https://t.co/J6N8JsvOTZ

[Elastic Security Labs @elasticseclabs]

Hijacked YouTube channels are pushing an emerging infostealer.

We're tracking #REVSTEALER: at least 17 compromised channels advertising free game cheats, funneling viewers to 2 malicious domains.

The stealer itself is built for long-term operation:
- Sandbox scoring: 10 weighted checks, self-terminates at a score of 7+
- App-Bound Encryption bypass: reads the decrypted key from browser memory under debugger control
- EtherHiding: fallback C2 stored in a Polygon smart contract, swappable without touching the binary
- Gaming focus: session cookies from Steam, Battlenet, and Roblox, feeding account resale markets
- 4,700 related samples hit VirusTotal in the past year.

Our team observed 4 follow-on modules that haven't been publicly documented until now.

Full analysis, whitepaper, YARA rule, and an IDAPython string decryption tool by @k33b0i, @soolidsnakee and @DanielStepanic:
Blog: https://t.co/4jGSZ2Tidg
Whitepaper: https://t.co/P8yqn0uCdT

[Elastic Security Labs @elasticseclabs]

We reverse engineered malware built to kill our own EDR.

In August 2026, eSentire documented a ClickFix campaign selling a DLL sideloader as a service.

It drops a malicious mscoree.dll next to a signed Microsoft binary, vb7to8.exe. Windows loads the planted copy first. Attacker code then runs inside a trusted process.

The kit also ships a vulnerable driver (BYOVD) to disable EDR, including Elastic Endpoint.

So we rebuilt it. A NativeAOT .NET 7 library, exports faked, a module initializer that fires on load.

We dropped it beside vb7to8.exe and ran it.

Elastic Defend 9.5.0 flagged the load as DLL Hijack: Masquerading.

Detecting this before 9.5.0 took ~88 lines and a list of ~2,600 library names. Now it's one line.

MITRE ATT&CK: T1574.001 (Hijack Execution Flow: DLL), T1036 (Masquerading).

Reverse engineering walkthrough, the .NET rebuild, and the detection breakdownby @0xfluxsec and @django88_: https://t.co/l1xdUTa7tN

Original campaign research by @eSentire.

[Elastic Security Labs @elasticseclabs]

A new Shai-Hulud campaign deployed a self-propagating worm across the npm supply chain.

Our supply chain monitor caught it yesterday, August 4th. The campaign targeted keyv: 600 million monthly downloads.

CHAINDROP activates on stolen npm tokens with write permissions, then backdoors every package the victim controls.

Over 400 npm packages compromised.

Full research and IOCs in the blog: https://t.co/ADYaOU6L0X

[Elastic Security Labs @elasticseclabs]

wp2shell PoCs went public within hours of disclosure, and we are seeing active exploitation.

Pre-auth RCE in WordPress Core. No plugins required.
CVE-2026-63030 and CVE-2026-60137.

We ran the Icex0 PoC end-to-end with Elastic Defend.

On the host, every run ends the same way.
The web server writes PHP under wp-content/plugins/, then spawns a shell.

4 rules caught it:
- Payload Execution by Web Server: EDR, kills the shell on launch
- PHP File Creation in WordPress Plugin Directory: catches the drop before execution
- Suspicious Command Execution via Web Server: flags discovery commands from the web parent
- Unusual Command Execution via Web Server: alerts on command lines the host has never run

The PoC self-cleans after running.
A missing plugin folder doesn't mean a clean host.

Patch to 7.0.2 or 6.9.5. Hunt the IOCs while tooling is still stock.

Full rule walkthrough, process lineage, and Attack Discovery correlation: https://t.co/OZ1pYzUiXw

[Elastic Security Labs @elasticseclabs]

7 trojanized repos targeting developers. Zero detections across every AV vendor.

Elastic Security Labs is tracking a new Contagious Interview campaign (REF9403) where DPRK-aligned actors distribute fake coding challenges through Slack job postings.

The repos masquerade as real Next.js e-commerce projects. The code was copied from a legitimate template called GoCart. The difference is steganography.

Base64 payload fragments are hidden inside HTML comments in SVG flag images. A script reassembles them alphabetically, decodes with a custom function, and runs on server start.

What deploys:
- Credential stealer targeting 25 crypto wallet extensions plus browser login data
- File stealer scanning for .env, .pem, .ssh, .aws, documents, images, shell history, and source code
- Socket. IO RAT providing real-time interactive shell access
- Clipboard stealer polling every 500ms, plus a Windows dropper downloading 3 disguised executables from the C2

Full analysis from Elastic Security Labs by @danielstepanic : https://t.co/EetHfm7lXu

[Elastic Security Labs @elasticseclabs]

TELEPUZ is a new modular malware spreading via CLICKFIX-VIDAR chains. Elastic Security Labs is tracking it.

Active since late April 2026. The delivery path: ClickFix social engineering tricks users into running a PowerShell command that downloads a VIDAR Go variant, which then fetches a lightweight stager and the main TELEPUZ payload.

The core DLL communicates over WebSockets and pulls additional modules from C2 on demand:
Keylogger
Stealer
Web injector: intercepts browser sessions via CDP and WebDriver BiDi, with default configs targeting financial form fields like IBANs

36 commands. Indirect syscalls. AMSI and ETW patching. NTDLL unhooking. Multiple UAC bypasses.

Still in active development: the shellcode injection command returns a TODO placeholder.

C2 infrastructure is small (2 domains), but fallback methods include Telegram channels, Steam profiles, DNS records, and a Polygon smart contract that doubles as a kill switch.

New builds hit VirusTotal daily. The C2 footprint is small, but this thing is moving fast for something that started 2 months ago.

Full technical analysis: https://t.co/TTKETmNUwB

[SolidSnake(Salim Bitam) @soolidsnakee]

Ongoing #infostealer #campaign hitting devs. It's the "Contagious Interview" (DPRK style). Shows up as a coding test or job-interview repo. You run it, it beacons out, steals your whole environment, and opens a JS eval() backdoor. Been collecting #IOCs, sharing below 🧵

[Elastic Security Labs @elasticseclabs]

We tracked a new activity cluster targeting Mexican banking customers.

Elastic Security Labs discovered REF6045, an operator-assisted banking fraud campaign targeting customers of Mexican banks, fintechs, and cryptocurrency platforms through ClickFix fake-CAPTCHA lures.

The operation exhibits a reliance on AI-generated code and suffers from significant operational security (OPSEC) failures that exposed their infrastructure and their toolkit.

The toolkit gives operators a full fraud workflow from:
•Vishing overlay: lock the screen behind a fake bank warning
•Browser redirect: paste a phishing URL via automated keystrokes
•Clipboard swap: replace CLABE or card numbers mid-transfer
•Remote access: install Remote Utilities for hands-on takeover

Research by @k33b0i and @soolidsnakee.

Full analysis from Elastic Security Labs: https://t.co/a1mxxU6N1m

[cr3ghost @cr3ghost]

LLMs can now reverse engineer obfuscated malware. But what happens when malware authors use LLMs to iteratively obfuscate back?

Elastic Security Labs explored the arms race between LLM-driven reverse engineering and LLM-driven obfuscation. Who wins when both sides have the same tools?

This is the question every malware analyst, detection engineer, and red or blue teamer needs to be thinking about right now.

https://t.co/QURyXMRDcP

Author: @elasticseclabs

#MalwareAnalysis #ReverseEngineering #InfoSec

[Elastic Security Labs @elasticseclabs]

OXLOADER is staging shellcode in the PE .reloc section. Detection rates are low.

New research from Elastic Security Labs.

Legitimate toolchains don't emit code into .reloc. It's a static-analysis red flag, but most engines aren't catching it in practice.

Before dropping the payload, OXLOADER runs 5 checks:
- Emulation: malformed WNetAddConnection2W call, expects ERROR_BAD_NAME (0x43)
- CPU count: 3+ CPUs required
- RAM: 3 GB minimum via GlobalMemoryStatusEx
- Display refresh rate: 20 Hz floor via WMI Win32_VideoController
- Geography: CIS GEOIDs and Russian LANGID excluded

Pass all five, and a copied system DLL gets a new .xtext section injected with the shellcode. DonutLoader wraps the final payload: CASTLESTEALER.

Distributed via Google Ads impersonating Node.js. The ad campaign targeted US-based victims. The advertiser account has since been removed.

Elastic Defend catches the full chain behaviourally. Static engines largely miss it.

Full technical breakdown, YARA rules, and IOCs visit https://t.co/NoA6sCz3Q0 from @DanielStepanic and @k33b0i:

[ESET Research @ESETresearch]

#ESETresearch has discovered a supply-chain attack targeting stock investors in 🇻🇳Vietnam, distributing SPECTRALVIPER through the update mechanism of the FireAnt Metakit stock investment platform. https://t.co/kquAp6fM8b 1/4

[Elastic Security Labs @elasticseclabs]

PHANTOMPULSE routes C2 through Ethereum/Base/Optimism transaction inputs.

The blockchain resolver has zero sender verification.

That means one transaction from a defender overrides the C2 URL for every active implant simultaneously.

@soolidsnakee reverse-engineered the full implant: three injection techniques, a shared HWBP primitive that kills AMSI/WLDP/ETW in a single handler, and a 580c XOR signature you can use to hunt sibling wallets right now.

https://t.co/M0M3mzCzB0

[SolidSnake(Salim Bitam) @soolidsnakee]

#VirusBulletin round 2! 🥊(last one was 2 years ago for me) Me and @k33b0i will be there for #VB2026 presenting how #REF3927 managed to hijack 571+ IIS servers for an SEO fraud network. Swing by and catch up with the Elastic Security Labs team if you're around. https://t.co/MJFn3E71iQ

#vbconference #conference #research

[Elastic Security Labs @elasticseclabs]

We uncovered a new Brazilian banking trojan campaign: TCLBANKER.

What makes TCLBANKER notable isn’t just the malware itself, but how it spreads.

The campaign uses compromised WhatsApp and Outlook accounts to propagate through trusted user relationships, deploys targeted banking overlays, and incorporates anti-analysis techniques designed to evade detection.

For defenders, it’s another example of malware increasingly blending into legitimate user behavior and everyday communication channels, making detection harder and trust easier to exploit.

Our latest research breaks down the infection chain, propagation methods, evasion tactics, and detection opportunities observed across the campaign.

Read the full analysis: https://t.co/9z47oaEWdD