Threat Spotlight: Warm Cookie/Bad Space
Summary: Cisco Talos reports that WarmCookie, also known as BadSpace, has been distributed since at least April 2024 through malspam and malvertising campaigns using invoice and job-agency lures, with PDF attachments linking to malicious JavaScript that uses Bitsadmin to retrieve and execute the WarmCookie DLL. Talos identified multiple overlaps with 2023 activity by TA866, and code analysis found WarmCookie shares core functionality and coding conventions with the Resident backdoor, leading Talos to assess both were likely developed by the same entity.
What's compelling: WarmCookie gives an attacker payload deployment, command execution, screenshot collection and persistence, and in analyzed intrusions it served as the entry point for CSharp-Streamer-RAT and Cobalt Strike - so a single successful invoice-themed email can hand over a persistent foothold that escalates into full remote access.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026