Threat Spotlight: Astaroth — Maze of obfuscation and evasion reveals dark stealer
Summary: Cisco Talos detailed the Astaroth malware family, whose campaigns exclusively targeted Brazil over nine to 12 months using lures such as overdue invoices, COVID-19 respirator announcements from a fake Ministry of Health, and threats to CPF tax-document status. The infection chain ran from spam links through iframes and Google Drive-hosted ZIP files to obfuscated LNK and JScript downloaders that pulled a modular DLL stealer, with dozens of anti-analysis checks that force a reboot if any fail.
What's compelling: The operators built dozens of evasion checks, including sandbox and virtual-machine detection, and used YouTube for command-and-control updates, so commodity defenses tuned to one or two anti-analysis tricks may not see this at all. Talos warns the targeting could move beyond Brazil and South America.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026