Forest Global Training Partners

Cyber Risks · Cisco Talos

Malvertising campaign leads to PS1Bot, a multi-stage malware framework

Summary: Cisco Talos has tracked a malvertising campaign active throughout 2025 that delivers a PowerShell and C# malware framework it calls PS1Bot, which loads follow-on modules in memory without writing them to disk and establishes persistence across reboots. The chain begins with a compressed archive containing a "FULL DOCUMENT.js" downloader, which writes a PowerShell script to C:\ProgramData\ that derives a C2 URL from the C: drive serial number and polls the server in a loop, executing returned content via Invoke-Expression.

Why it matters: The grabber module scans for data tied to dozens of browsers, Chromium wallet and MFA extensions, and locally installed crypto and authenticator applications, then hunts files by wordlist for wallet seed phrases and passwords - so a single successful click reaches credentials, session tokens, and recovery phrases, not just one account.

Read the original at Cisco Talos ↗

Topics
Malware
Related