AZORult brings friends to the party
Summary: Cisco Talos traced a campaign in which a ZIP-compressed, possibly password-protected ISO image delivered a PowerShell downloader that pulled its next stages from githubusercontent.com, disabling Windows Defender and Windows Update along the way. The loader branched on privileges: administrators got Remcos RAT, Defender exclusions, and services named WinDefends, thundersec and WindowsNetworkSVC, while non-administrators got DarkVNC and an XMRigCC miner persisted through a scheduled task named OneDrive SyncTask, and all paths ended with an Azorult variant injected into notepad.exe via RunPE.
What you should know: The clipboard stealer's Bitcoin address, 3Csd9Zq4r16dVQuREs52y5eJFgYEqQjAx1, earned just under six Bitcoins by swapping wallet addresses in copied text every half second - a reminder that a single infected endpoint can quietly redirect payments, not just leak data.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026