VMRay

Sandboxing reinvented for the threats of today - and tomorrow. | Imprint:

[VMRay @vmray]

🔥 Alert: Chrome extension lets attackers remotely control out-of-focus browser windows to keep malicious actions hidden

🔗 Report: https://t.co/Vz351iWmcm

We found a sample likely written in Rust which drops Stealc and a malicious Chrome extension pretending to be GoogleTranslate.

The extension can extract the browser history, bookmarks, a list of installed extensions, credentials, and cookies. It also provides threat actors with a live stream of Chrome windows and allows them to remotely control websites using mouse clicks and keyboard input.

However, to hide those remote actions from the victim's view, the extension also allows remote control of out-of-focus windows in the background.

Furthermore, the extension can overlay legitimate login forms with an iframe from a phishing page while keeping the legitimate domain visible in the address bar.

💡 In a nutshell:
- Rust binary drops malicious Chrome extension and AutoIt script, which in turn drops Stealc.v2
- Chrome extension pretends to be Google Translate
- Extension steals browser history, cookies, and credentials
- Provides features to remotely control inactive Chrome windows, set a proxy, and inject malicious JavaScript into specific sites
- Can live-stream tab content and allow attackers to interact with it remotely
- Can perform a man-in-the-browser attack by replacing the site content with an iframe loading from a phishing page

🧬 IoCs:
http[:]//87.120.104[.]147:8080
http[:]//160.20.109[.]33:80
7ba2c663d76d2d353a02d815381f22a1b04b2032162b1559455d1f456432340a (Rust binary)
02e9da11f035bd4e18338ddd78e2818da49e7d1c8f614e9b329afaf581c33301 (Chrome extension)
4f82542f68d2e677fb64ba986c8d5f3a04017a1bf7a11d375e52f950e32eb262 (AutoIt script)
45c7d791fab4128fb495f359ed641e217883f132bb8f13c1e181caf5f5279a34 (Stealc v2)

[VMRay @vmray]

Threat actors keep finding ways to make phishing look ordinary. https://t.co/I4xgh5ynn0

A sign-in page that asks you to clear a CAPTCHA first.
A link that passes through a few legitimate redirect services before it lands.
A next-stage address fetched from a Web3 service at runtime, so nothing malicious is written into the page itself.

Detecting this comes down to reading behavior, not appearance.

July's Detection Highlights documents what the VMRay Labs team shipped to do exactly that:

🔹 Meta-VTIs for the Sneaky2FA and Tycoon2FA phishkits, correlating the individual network behaviors that only form a clear pattern when seen together
🔹 Detection for Web3 services used as dead-drop resolvers to hide next-stage infrastructure
🔹 Detection for suspicious multi-step redirect chains that obscure a link's real destination
🔹 New email VTIs for urgency and pressure language, brand impersonation, and lure images loaded from public hosting
🔹 New config extractors for Phorpiex, NetSupport Manager, ScreenConnect, and ValleyRAT, plus 50+ new YARA rules

The full breakdown, with the behavioral context behind each detection, is in the link.
🔗 https://t.co/I4xgh5ynn0

[Tim Blazytko @mr_phrazer]

Thanks to @vmray for hosting today's webinar on agentic malware analysis!

We covered tool-driven RE workflows, local LLMs, guardrails, validation, and more.

Thanks for all the great questions!

Slides: https://t.co/0J4e5u08CK

Recording: https://t.co/V9kEPTvsSn

[CyberDefenseMagazine @cyberdefensemag]

🚨 Congratulations to @vmray on being named a Top Infosec Innovator Awards 2026 Finalist during #BlackHat!

Featured in the BlackHat Spotlight by Cyber Defense Magazine. Watch for this cybersecurity innovator at the #CyberDefenseCon CISO Conference this October in Orlando. 🌟

#CISOConference

[Windows Forum @windowsforum]

🛡️ Operation STANDOFF proves malware doesn’t need a zero-day when it can cosplay as Windows itself. A fake csrss.exe, Defender evasion, credential theft and crypto mining? Corporate IT’s worst multitasker.
https://t.co/O4lvzztkbx
#CredentialTheft #WindowsMalware

[RST Cloud @rst_cloud]

#threatreport #HighCompleteness
Execution-Level Analysis of a Russian-Speaking Multi-Operator Intrusion Campaign: Operation STANDOFF | 20-07-2026
Source: https://t.co/nOhkE6sZfI
Key details below ↓

🧑‍💻Actors/Campaigns:
Operation_standoff (🧠motivation: financially_motivated, disinformation, cyber_criminal, information_theft)

💀Threats:
Raccoon_stealer, Redline_stealer, Amadey, Smokeloader, Socelar, Glupteba, Xmrig_miner, Asprotect_tool, Aspack_tool, Enigmaprotector, Cryptone_tool, Process_hollowing_technique, Loaderbot, Passview_tool, Antidebugging_technique, Dead_drop_technique, Passthehash_technique, Password_spray_technique, Printnightmare_vuln,
🎯Victims: Mobile gaming audience, Corporate active directory environments, Enterprise networks, Telegram channels and discussions, Russian speaking mobile gaming ecosystem

🏭Industry: Entertainment

🌐Geo: Korean, Moscow, Russian, Russia

🔓CVEs: CVE-2021-34527 \[[Vulners](https://t.co/IwWqhSYhqo)]
- CVSS V3.1: *8.8*,
- Vulners: Exploitation: True
Soft:
- microsoft windows_10_1507 (<10.0.10240.18969)
- microsoft windows_10_1607 (<10.0.14393.4470)
- microsoft windows_10_1809 (<10.0.17763.2029)
- microsoft windows_10_20h2 (<10.0.19042.1083)
...

🤖LLM extracted TTPs:`
T1012, T1027.002, T1027.007, T1036.004, T1036.005, T1047, T1053.005, T1055.012, T1059.001, T1059.003, ...

🧨IOCs:
- IP: 55
- Url: 26
- Domain: 28
- File: 21
- Coin: 1
- Path: 3
- Hash: 1

💽Software: Active Directory, Telegram, WhatsApp, NET Reactor, Microsoft Defender, Windows Update service, VirtualBox, VBoxGuest, Windows Firewall, bcdedit, ...

🪙Crypto: monero

🔢Algorithms: md5, sha1, sha256

🗂️Win API: IsDebuggerPresent, NtQueryInformationProcess, CreateServiceW, SeDebugPrivilege, SeImpersonatePrivilege, SeLoadDriverPrivilege, BitBlt, WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, ...

📜Programming Languages: golang, powershell, javascript

💻Platforms: x64

#threatreport:
Operation STANDOFF is a complex cybercriminal campaign conducted by an organized Russian-speaking threat group, unifying multiple techniques encompassing the distribution of various commodity malware, establishment of a proxy-botnet, network intrusions, and AI-driven influence operations. This campaign utilizes infrastructure hosted by TimeWeb Ltd. in Russia while disguising traffic to appear as ordinary requests directed to the GitHub domain.

The attack begins with a pay-per-install (PPI) loader that deploys a suite of malware, including prominent threats like Raccoon Stealer and RedLine, which are designed to collect credentials and sensitive information while integrating the compromised machines into a proxy-botnet system. This infrastructure cleverly employs evasive techniques such as HTTP 301 redirects to legitimate domains to obscure its malicious activities from detection tools and security analysts.

The command-and-control (C2) setup for Operation STANDOFF relies on several servers (specifically IP addresses 212.193.30.29 and 212.193.30.45) which manage the operations behind the scenes. The C2 servers maintain a complex interaction model where malicious components communicate through malformed HTTP requests that mimic benign traffic. Notably, one server facilitates a custom console called "STANDOFF COORD," designed for effective coordination of targeted intrusions, while another primarily serves proxy lists to infected hosts, thus converting them into relay nodes for further operations.

The malware exhibits advanced defensive evasion tactics, including disabling security tools like Microsoft Defender, utilizing anti-VM checks, and employing techniques for obfuscating its actions through process hollowing and code injection. Its execution traces reveal persistent mechanisms to maintain long-term control over infected systems, making it a significant threat to targeted enterprises.

Additionally, the operation employs a sophisticated influence and outreach strategy through a Telegram account farm, coupled with an automation platform that utilizes AI for generating content and managing interactions across different messaging channels. The infrastructure incorporates a public-facing website that captivates an audience interested in mobile gaming, further allowing the malicious actors to channel traffic towards their nefarious activities, including promoting illicit services related to gambling and fraud.

The convergence of automated, opportunistic cybercrime with human-operated intrusion methods reflects a shift in the landscape of cyber threats, where financially motivated attacks now intertwine with informational manipulation efforts. The components of Operation STANDOFF collectively illustrate how contemporary cyber threat actors can leverage shared infrastructure to conduct multifaceted campaigns that not only compromise specific targets but also propagate broader influence across online platforms. Security measures at this point need to focus on detecting this ongoing operation, many elements of which remain undetected by existing defenses.

[Daily CyberSecurity @Daily_CyberSec]

Discover VMRay Labs' execution-level analysis of Operation STANDOFF, a Russian-speaking multi-operator campaign deploying stealer malware and AI bots.
#OperationSTANDOFF #VMRayLabs #MalwareAnalysis #Infostealers #Cybersecurity
https://t.co/RsLzsvR0V4

[VMRay @vmray]

A scanner probes an unfamiliar IP. The server responds with a 301 redirect to github[.]com. Nothing to see. Move on. That was the point. https://t.co/cVz0jShsOP

VMRay Labs has published an analysis of Operation STANDOFF, a previously unattributed cybercriminal operation running on at least 44 servers, every one of them configured to answer unsolicited HTTP requests with a redirect to GitHub.

To an analyst or an automated scanner, the infrastructure looked unremarkable. Its traffic blended in with ordinary GitHub communication.

Our investigation started from a single UniqueSignal finding, a behaviour-level detection surfaced from hypervisor-level observation of what a sample actually did at runtime, rather than from any reputation or signature match.

From there, execution-level analysis and infrastructure pivoting reconstructed something considerably larger than one malware host:

🔹 A pay-per-install loader distributing Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba and XMRig, while disabling security controls and establishing rootkit-grade persistence
🔹 A proxy-botnet enrolling compromised hosts as traffic-relay nodes
🔹 A custom multi-operator console for coordinating hands-on-keyboard intrusions into corporate Active Directory environments
🔹 A large-scale, AI-assisted influence and engagement-manipulation platform operating across email, Telegram and WhatsApp

All of it on shared infrastructure. Much of it still undetected by security vendors at the time of writing.

Written by Hasan Mevzi.

🔗 https://t.co/cVz0jShsOP

[VMRay @vmray]

🧬 IoCs:
05be9040355ba0dc285f6711c2e8866e9a40882f0e65215c103fe022571686e2 (SHA256 PyInstaller)
f00afe68449319e719c9d3163e907b2b7d291b13ba95fdf2a769909c29ab8528 (SHA256 PYC)
https[:]//api.telegram[.]org/bot7844252042:AAGxUHCvfK3S0X8fSN9fr1LkRaBO4sRkI8A/sendMessage?chat_id=7552001215

[VMRay @vmray]

😯 A curious finding: Python malware drops and compiles three C source files at runtime ( ! ) to steal credentials

🔗 Report: https://t.co/q0Dh2gN0lk

We have identified an information stealer called “ULTIMATE STEALER” or “Ishmael_19Bot” written in Python and distributed as a PyInstaller executable which includes an extensive list of techniques for extracting credentials and sensitive documents, such as scans of passports or tax returns.

Curiously, the sample also comes embedded with three C source code files that it attempts to compile at runtime to extract additional credentials or perform low-level evasion checks. To compile them, it checks the system for Visual Studio installations before using build tools such as "vcvarsall.bat".

💡 In a nutshell:
- While there is some overlap between the functionality implemented in Python and C, the latter is mainly responsible for more performance-heavy credential extraction, such as scanning process memory for passwords, as well as low-level evasion techniques, but the Python module operates regardless of whether the C code is compiled successfully
- Python code tries to find documents related to passports, driving licenses, ID cards, birth certificates, bank statements, tax returns, and more, with support for PDF parsing
- Supports process injection, DLL injection, screenshot capture, and stealing cryptocurrency wallets, browser credentials, Wi-Fi passwords, and clipboard contents
- Performs a variety of anti-analysis checks, including IsDebuggerPresent, CPUID, checks for sandbox-related process names and VM artifacts
- Uses numerous persistence methods, including via the registry, scheduled tasks, services, WMI, LNK hijacking, COM hijacking, DLL hijacking, browser extension installation, and Image File Execution Options (IFEO)
- Appears to contain AI-generated code and could be a work in progress
- Compresses and exfiltrates data via Telegram
- Curiously, the Python sample imports a speech recognition library but does not appear to use it anywhere

[VMRay @vmray]

Modern phishing pages don't reveal themselves right away. A button to click. A checkbox to mark. A prompt to accept. Only after the interaction does the real payload appear. For automated analysis, that creates a gap: if the sandbox doesn't act the way a person would, the attack stays hidden. https://t.co/KNJ10749hc

Browser automation has long relied on a page's underlying structure, the DOM, to find and click elements. That works well when the structure matches what the user actually sees. It struggles when an overlay covers a button, or when something is plainly visible on screen but hard to pin down in code.

VMRay Platform 2026.3 closes that gap with AI Browsing Simulation. It adds a visual perception layer on top of the existing automation, using computer vision and OCR to read a page the way a person sees it.

Buttons, checkboxes, prompts, and labels get identified from the screenshot itself, with the visual read validating the cases where the page and its code don't line up. Fewer missed interactions on evasive, visually complex phishing pages. The model runs locally, and customer data is never used to train it.

The release also brings IR Mailbox webhooks to automate what happens after analysis, customizable submitter notifications, and KnowBe4 PhishER tag filtering to control what gets sent for analysis in the first place.

🔗 https://t.co/KNJ10749hc

[VMRay @vmray]

Neither detail was unusual on its own. A non-standard port. A generic Microsoft HTTP server banner. Plenty of legitimate services run exactly that, so on their own, neither tells you much. Together, they were selective enough to hunt on. https://t.co/Ji0mD450BW

That is one of the more useful lessons in a recent VMRay blog investigation by independent researchers. Starting from a single RedLine C2 surfaced through VMRay UniqueSignal, the analysis pulls the C2's HTTP response from the VMRay's sandbox and turns one specific pairing, the high port and the server string, into a fingerprint.

That fingerprint becomes the pivot: a query against internet-wide scan data to find other hosts sharing it, without ever touching the target infrastructure directly, which keeps the investigation quiet.

The full investigation includes every query used, so the approach is reproducible.

🔗 https://t.co/Ji0mD450BW

[VMRay @vmray]

Most ThreatIntelligence work stops at the blocklist. You take an indicator, confirm it's live, push it into a SIEM rule, and move on. Pivoting takes the same indicator further, and sometimes it leads somewhere you didn't expect. https://t.co/Ji0mD450BW

The new investigation on the VMRay blog starts with a single RedLine Stealer C2 IP pulled from VMRay UniqueSignal and follows it outward.

The RedLine infrastructure itself was a short thread. But the files communicating with that C2 pointed somewhere else entirely: a tailored spear-phishing campaign targeting a South Korean maritime manufacturer, delivered through business email compromise.

From there, the investigation moves to the email distribution infrastructure behind the campaign, and surfaces a cluster of attacker-owned domains and servers, each one blockable at the email gateway before the next wave lands.

🔗 https://t.co/Ji0mD450BW

[VMRay @vmray]

🇵🇹 Despite years of investment in Secure Email Gateways, phishing is still one of the most effective ways into an organization. The question worth asking isn't why attackers keep trying. It's why they keep succeeding. https://t.co/CouA5eiWVd

Tomorrow, VMRay is at BSides Porto. And on Day 2, Andrey Voitenko takes the stage to dig into exactly that.

His talk, looks at a structural reason phishing slips through: SEGs are built for speed and scale, processing huge volumes of email with minimal latency.

That optimization comes at the cost of depth, and sophisticated campaigns are designed to exploit exactly that blind spot: Multi-stage redirect chains. QR codes. SVG images. HTML smuggling. Geolocation- and time-based payload activation.

Andrey will also cover a practical, often-overlooked fix: connecting your User-Reported Phishing program to advanced sandboxing that operates outside real-time delivery constraints. The kind that simulates real user interaction, follows complex redirect paths, and exposes evasive payloads safely, with real-world examples including QR-code attacks and ClickFix.

If you're in Porto, catch the talk. Let's have a conversation after.

[VMRay @vmray]

Consolidation looks like a cost decision on paper. In practice, it's a trust decision. Removing a tool means relying on what remains, and a security team can only makes that move when they're confident that what's left can be trusted to hold. https://t.co/Ew3csvh6Ar

A major US financial services SOC leader pursued a clear strategic goal: optimize their investment by consolidating around Microsoft Defender for Office and Endpoint, and divest from another significant security tool.

The condition? A validation layer accurate enough to confirm Microsoft Defender's verdicts and clean enough to dismiss false positives at scale. Without it, the consolidation risked exchanging cost savings for operational drag and undetected threats.

VMRay became that layer. In the security leader's words:

"Our strategic goal was to fully utilize Microsoft Defender. We needed to ensure it was supported by trustworthy validation, and VMRay was the critical enabler that gave us that confidence."

When consolidation works, it's because the analysis foundation can carry the weight.

[VMRay @vmray]

🔥 Alert: One Russian-speaking crew, one set of servers: a malware botnet, a hands-on console for breaking into corporate networks, and an AI Telegram troll farm.

🔗 Report: https://t.co/L2Zpg1qKve

We track it as Operation STANDOFF. The starting point was a single sample that VMRay UniqueSignal flagged on behavior, not a signature or known indicator. Pivoting on the two hardcoded C2 IPs it contacted at runtime revealed the wider operation. One IP also hosted the operators' console, "STANDOFF COORD". The same Russian-speaking crew runs three revenue-generating operations from one server infrastructure: a commodity malware botnet, hands-on intrusions into corporate networks, and an AI-driven Telegram troll farm (fake accounts and GPT-written personas generating engagement at scale). Much of the C2 blends in by redirecting requests to GitHub; pivoting on that pattern uncovered 44 related Russian servers.

💡 Takeaways:
• Financial and influence operations run side-by-side. Malware steals credentials and crypto wallets, mines Monero, enrolls victims into a proxy-botnet, and supports hands-on corporate intrusions. The Telegram operation uses AI-generated personas for engagement manipulation, disinformation, promotions, scams, and audience building.

• VMRay UniqueSignal flagged the sample based on behavior and exposed two hardcoded C2 IPs (212.193.30[.]45/proxies.txt and 212.193.30[.]29/server.txt) that led to the broader infrastructure.

• The malware C2 also hosted "STANDOFF COORD", a multi-operator console containing stolen NTLM hashes, Kerberos tickets, session cookies, and private keys.

• A single loader deploys Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig while disabling Windows Defender and Windows Update.

• Persistence is achieved through a fake csrss.exe dropped into C:\Windows\rss and installed as a startup service using VirtualBox-style names.

• Victims are enrolled into a proxy-botnet through 212.193.30[.]45/proxies.txt, creating traffic relays for operator use or resale.

• The influence operation uses AI-generated Telegram accounts connected to a Standoff 2 / PUBG Mobile gaming portal that funnels a young audience.

• The C2 hides in plain sight: 44 TimeWeb-hosted servers redirect requests to GitHub to blend in with trusted traffic.

• A malformed WinHTTP User-Agent corrupted to a single 0x02 byte provides a distinctive network signature.

• Attribution points to a Russian-speaking team through Russian-language tooling, Moscow-time scheduling, and consistent "ggstandoff" / "GG Influence" branding.

[VMRay @vmray]

🧬 IoCs:
URL: hxxps://localgolf[.]globalmerx[.]es/ssa/Windows/utility.php
C2: 64[.]89[.]161[.]167:5173 (Overlord RAT)
SHA256: 3e98101a03ad5606130bf5998799c05c6de7dcd97ad9e79bc776f3b5fb830609 - ACHRemittance.msi
SHA256: 76ee58191bc408e3f1a5283574c61d331d61b9fd0203d7bffc879761e725b3db - hmlinears.vbs

[VMRay @vmray]

🔥 Alert: Weaponizing Overlord RAT — open-source Golang RAT in DocuSign-themed phishing

🔗 Report: https://t.co/u60FKomOjF

We have recently spotted a phishing campaign, which utilizes a new, open-source malware called OverlordRAT written in Go.

The chain starts with a malicious URL, which points to a domain impersonating the logistics company Global-Merx. The URI resource - utility.php - mimics an official DocuSign page and uses embedded JavaScript to trick victims into downloading a document of ACH Remittance payment, which is a malicious MSI installer, but we’ve seen the payload getting changed recently. The installer embeds a DLL stager and gets called via the CustomAction table of the fake Microsoft DirectX Runtime MSI installer. The DLL finally injects its payload to werfault.exe, decrypts the final stage Overlord RAT payload with XOR (0xA9) and executes it.

The use of Overlord RAT again reinforces our previous findings that actors are always on the lookout for adopting new tools in their attack arsenal.

🔑 Takeaways:

- URL → DocuSign phishing → MSI → DLL → EP injection (werfault.exe) → XOR (0xA9) → Overlord RAT
- MSI and DLL disguised as Microsoft DirectX Runtime files, embedded payload called via CustomAction table
- DLL stager injects to werfault.exe, decrypts Overlord RAT payload with XOR key 0xA9
- The open-source Overlord RAT handles encrypted WebSocket traffic, provides HTTPS, JWT, RBAC and MFA authentication, flexible remote desktop streaming (WebRTC, MediaMTX) and supports Windows, Linux and macOS platforms

[VMRay @vmray]

A phishkit rarely looks malicious if you take its behaviors one by one. https://t.co/oTMEUqP2Qs

A connection to Microsoft's real authentication infrastructure: legitimate.
A reference to the genuine Microsoft password-reset page: legitimate.
A block of login-related text: legitimate.
Each behavior, on its own, appears in countless trustworthy applications.

It's when they appear together, in the same sample, that the pattern emerges.

That's the logic behind one of this month's additions from VMRay Labs: a new meta-VTI that correlates several individually-benign behaviors into a single classification, improving detection of EvilProxy-style phishkit activity, the kind built around adversary-in-the-middle credential and token theft.

The full breakdown is in the link.
🔗 https://t.co/oTMEUqP2Qs

[VMRay @vmray]

Something gets blocked. The alert closes. Everyone moves on... That's the moment most SOC teams know the least about what just happened. https://t.co/ZlBv19Yi5l

Microsoft Defender stops threats at scale. That's what it's built for, and it does it well. But blocking an attack before it executes carries a trade-off: some of what the attacker was trying to achieve never gets observed.

The files that would have downloaded. The infrastructure it was set up to communicate with. The next move in the chain. The question is what to do with everything blocked at the perimeter: the alerts that, on closer inspection, would have a lot to teach the team.

That's what our latest post explores: where deep, evasion-resistant analysis fits alongside a strong Microsoft Security program, and why the gap between blocking and understanding is worth closing.

🔗 https://t.co/ZlBv19Yi5l