The internet is already scary enough without April Fool’s jokes
Summary: Cisco Talos reported a new financially motivated threat actor it calls CoralRaider, believed to be of Vietnamese origin and operating since at least 2023, targeting victims in Asian and Southeast Asian countries to steal credentials, financial data, and social media accounts. The group uses RotBot, a customized QuasarRAT variant, and the XClient stealer as payloads, abuses a legitimate service to host its C2 configuration file, uses LoLBins including Windows Forfiles.exe and FoDHelper.exe, and spreads primarily through malicious LNK files by means not yet known.
Key Takeaway: CoralRaider's focus on social media logins, including business and advertisement accounts, means a stolen account can later be used to spread scams and misinformation under a trusted name, and Talos does not yet know how the malicious LNK files are delivered.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026