Ocean Lotus: Extending Cyber Espionage Operations Through Fake Websites

Summary: Volexity identified multiple OceanLotus campaigns using fake Vietnamese-language news websites and Facebook pages, some with over 10,000 scraped articles, that profile visitors and deliver malware for Windows, OSX, and Android. On one baomoivietnam.com article, malicious JavaScript served a fake Flash Player update that downloaded a RAR archive containing a legitimate Google updater executable and a hidden malicious goopdate.dll, which loaded a Cobalt Strike stager into memory via search order hijacking.
Why it matters: The payload relied on a legitimate signed Google updater and a hidden DLL to slip past users who saw only a single executable, and the same sites served phishing links to iOS and Android visitors through Dropbox, Amazon S3, and Google Drive.

Read the original at Volexity Blog ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026