ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories

A familiar repo. A useful installer. A harmless sync setting. Then the handoff goes bad, the box starts talking to someone else, and the damage moves faster than the explanation.

Old bugs are back, weak defaults are earning their keep, and some attack paths are so plain they barely feel like research. Here’s the mess.

• **Game cheats drop spyware:** Cybersecurity researchers have published 11 malicious NuGet packages as .NET command-line tools, presented as game utilities, bots, and “panels.” These act as first-stage downloaders, fetching and executing a second-stage Python payload named "pepesoft.exe" from GitHub Releases and Hugging Face under the username "pepegit666," with a dormant BitTorrent fallback mechanism. The recovered payloads use AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware, and honor a remote HWID/UUID ban-list. In the three direct-bytecode payloads, the larger game-automation application also exposes Telegram bot commands that can send screenshots back to the configured chat.

• **Fake installers deploy RATs:** UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary, has been observed conducting a malicious campaign targeting users in the U.S. and Europe since June 2026. The activity delivers a Python-based remote access tool (RAT) dubbed Starland RAT and a command-and-control (C2) memory implant known as WLDR agent using trojanized installer lures for software like developer tooling, IT administration utilities, enterprise collaboration platforms, and consumer gaming applications (e.g., MobaXterm, WebEx, Zoom, DBeaver, and FaceIT). "The WLDR agent is a sophisticated PowerShell-based C2 memory implant that features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads," Cisco Talos said. Alternatively, UAT-11795 has been linked to the deployment of CastleStealer and Remcos RAT. The malware is designed to target victims’ credentials and cryptocurrency wallet assets, harvest Active Directory information, and establish a persistent connection to the victims’ machines from the C2 server, likely with an aim to deliver and execute further payloads. The majority of the infections are in the U.S., with fewer potential impacts recorded in Germany, Romania, and Venezuela. The attack chain makes use of ClickFix lures to distribute HTA scripts, which then download and run trojanized installers to deliver Starland RAT, which then uses "curl.exe" to execute a PowerShell stager for decrypting and running WLDR agent. In recent weeks, ClickFix has also served as a conduit for TELEPUZ, a modular malware, and ClickLock Stealer, a macOS-focused information and cryptocurrency wallet stealer targeting users in Europe, North America, and MEA. "ClickLock Stealer targets data from 8 browsers, 31 crypto wallet browser extensions, 7 password manager extensions, 8 desktop wallet applications, extracts blockchain addresses across 6 chains, macOS Keychain, shell history, and FTP credentials," Group-IB said.

• **Network encrypted within hours:** An IT services company in South Asia was targeted by a previously undocumented ransomware family called Spirals in June 2026. "The Rust-based payload is either a new ransomware threat or one purpose-built for this attack," Broadcom’s Symantec and Carbon Black Threat Hunter Team said. "Less than 24 hours after the initial breach, the ransomware payload was being pushed to machines on the network." The attacker is said to have obtained initial access by compromising an internet-facing IIS web server and uploading an ASP.NET web shell. Over the next three hours, they established persistent access, conducted reconnaissance, uninstalled endpoint security software, dumped the Security Account Manager (SAM) hive, and set up covert remote access prior to deploying the payload across the network using PsExec. The ransom note seeks to apply pressure by threatening to publish stolen data after six days if a ransom is not paid and directs victims to a Tor portal for negotiations. The actor behind the attack remains unknown.

• **Actively exploited flaws:** The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-46817, an improper privilege management vulnerability in Oracle E-Business Suite, and CVE-2023-4346, an overly restrictive account lockout mechanism vulnerability in KNX Association KNX Protocol Connection Authorization Option 1, to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by July 18 and 29, 2026, respectively. Reports about active exploitation of CVE-2026-46817 emerged late last month. It's currently not known how the KNX Protocol flaw is being abused and by whom.

• **New rules for vulnerability reports:** CISA, in partnership with the National Security Agency (NSA), Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), Netherlands’ National Cyber Security Centre (NCSC-NL), and United Kingdom’s National Cyber Security Centre (NCSC-UK), has published joint guidance to “helps software manufacturers and online service providers collaborate effectively with security researchers who identify weaknesses in software, networks, and hardware in a structured, transparent framework.” The agency said a “well-defined coordinated vulnerability disclosure (CVD) program enables software manufacturers and online service providers to better assess potential risk, improve their vulnerability management processes, and make informed decisions that improve product security for their customers.”

• **700-person scam network dismantled:** Authorities from the Netherlands have arrested a 46-year-old man with Israeli and Polish citizenship, who is alleged to be behind an international criminal organization with more than 700 employees who were employed at about 20 fraudulent call centers. These individuals posed as financial advisors to conduct investment fraud. "By maintaining regular contact, sometimes over a period of months, these scammers build a bond of trust with their victims,” the Dutch police said. “The initial deposit is always a relatively small amount that yields an immediate profit. The online platform where victims can view their investments is indistinguishable from the real thing, yet in reality, no actual investments are being made. Scammers use a friendly approach and cunning tactics to manipulate victims into depositing ever-larger sums. The money – often cryptocurrency – that victims believe they are investing ends up in the scammers’ pockets.” The operation has also led to the arrest of four “financial advisors.”

• **€140M fraud network disrupted:** Spanish National Police have disrupted a cybercrime network accused of stealing and laundering about €140 million through fake investment platforms, CEO fraud, invoice fraud, and adversary-in-the-middle attacks across Europe. Four people have been apprehended in connection with the operation: two in Portugal, one in Spain, and one in Panama. "The suspects established and managed a network of over 800 bank accounts to receive substantial sums of illicit money swindled from numerous victims; these funds were immediately dispersed and concealed across another network of accounts, creating a chain of transactions that safeguarded the criminal proceeds and allowed the vast amounts of defrauded money to be hidden and laundered through ‘money mule’ accounts in third countries,” police said. "To create the complex web of accounts used for money laundering, the group utilized an extensive network of money mules – European citizens who had arrived in Spain from other countries – to set up companies and subsequently open bank accounts across Spanish territory.”

• **Windows bind links evade EDR:** Bitdefender Labs has demonstrated three attack techniques in which Windows’ bind links can be misused to evade endpoint detection and response (EDR) products. “Windows includes a file-system virtualization feature that can redirect one local path to another without modifying the original file or leaving a persistent filesystem artifact,” Bitdefender’s Martin Zugec said. “It is implemented by bindflt.sys, the Bind Filter minifilter driver, and used legitimately by Store apps, Windows Sandbox, and Windows containers.” The techniques can be leveraged by an attacker running as a local administrator to bypass EDR sensors and built-in Windows defenses such as AMSI and AppLocker. The techniques include: File-Binding, Process-Binding, and Silo-Binding, each of which shadow a trusted file or DLL path, a trusted executable path, and a user-defined Windows silo. Microsoft has assessed the findings as low severity because it requires administrator access.

• **290 fake repos spread infostealer:** A financially-motivated threat actor has set up more than 290 fake GitHub repositories impersonating trusted software and security tooling vendors, including Arctic Wolf, to distribute a Windows infostealer that shares the same codebase as BoryptGrab. The 292 impersonated repositories span security tooling, fintech and personal finance, cryptocurrency wallets and exchanges, developer and productivity tools, secure email providers, macOS utilities, and gaming software. “The payload is a pure smash-and-grab in-memory infostealer, with a 41-entry cryptocurrency wallet path table and 19+ targeted browser names for broad, financially driven credential collection,” Arctic Wolf said. “Stolen data is packaged into a ZIP archive and exfiltrated to a C2 with an IP residing in Russia, on a hosting provider repeatedly associated with malware operations.” The malware does not set up persistence on the host and is instead designed to collect as much data as possible in a single execution. The brandjacking campaign is said to be the work of a Russian-speaking operator.

• **$62M cybercrime indictment:** The U.S. Justice Department has unsealed a December 2024 indictment charging three Russian nationals and two related bulletproof hosting companies for their roles in cybercrimes against U.S. victims, causing tens of millions of dollars in losses. The charges are against Alexander Alexandrovich Volosovik, Kirill Andreevich Zatolokin, Yulia Vladimirovna Pankova, Media Land LLC, and ML.Cloud LLC. In tandem, the U.S. Department of State’s Rewards for Justice (RFJ) program has announced its offering a reward of up to $10 million and possible relocation for actionable information on foreign government-linked associates of Pankova, Volosovik, and Zatolokin, their malicious cyber activities, or foreign government-linked use of Media Land or ML.Cloud. The defendants and the companies were sanctioned by the U.S., the U.K., and Australia in November 2025. Earlier this week, the Council of the European Union also levied sanctions against Media Land, ML.Cloud, and Volosovik, as part of the first joint cyber sanctions package issued against Russia in collaboration with the U.K.”,