MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities
Summary: Cisco Talos observed a February 2025 cluster of invoice- and billing-themed phishing emails targeting Ukrainian entities, carrying archive attachments with obfuscated JavaScript that downloaded and ran SmokeLoader via the Emmenhtal loader. Talos then found similar Emmenhtal samples in public GitHub repositories that delivered Amadey instead, which pulled custom payloads from accounts it assesses are part of a larger malware-as-a-service operation using GitHub as open directories.
What you should know: Three GitHub accounts hosted the tooling, and the most-used one, "Legendary99999," held over 160 repositories of payloads from numerous malware families - all downloadable by URL from a domain many development teams cannot simply block.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026