Coral Raider targets victims’ data and social media accounts
Summary: Cisco Talos assesses with high confidence that the CoralRaider operators are based in Vietnam, citing Vietnamese-language Telegram C2 bot channels, PDB strings, hardcoded words in payload binaries, and an IP address in Hanoi. The campaign targets victims across India, China, South Korea, Bangladesh, Pakistan, Indonesia and Vietnam via malicious Windows shortcut files that chain an HTA, obfuscated Visual Basic and PowerShell scripts to deliver the RotBot RAT and XClient stealer, which exfiltrates browser, social media and financial data to a Telegram bot C2.
Key Takeaway: The stealer pulls Facebook and Instagram business and ads account data, including payment card details, PayPal addresses and ad account balances, and ships it to a Telegram bot - a channel most security stacks do not inspect, so the theft can complete without tripping a web or email control.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026