A trojanized Atera RMM installer disguised as a bank eStatement PDF grants attackers persistent remote access including terminal, remote desktop, and arbitrary code execution — all through legitimately signed, commercially trusted infrastructure. Zero public detections at time of analysis. Likely Luna Moth / Silent Ransom Group campaign.
On March 24, 2026, threat actor TeamPCP published backdoored versions of the LiteLLM Python package (3.4M daily downloads) after compromising Trivy and Checkmarx security scanners to steal PyPI credentials from CI/CD pipelines. The malware harvested credentials, deployed Kubernetes worms, and established persistent C2 — all triggered by a Python .pth file that fires on every interpreter startup.
TLP: WHITE — This analysis is cleared for public release. All victim PII has been redacted. No credentials were submitted during analysis. IOCs are provided at the end for detection use. Overview A live QR phishing (“quishing”) campaign was captured in the wild targeting corporate employees via a weaponized PDF disguised as an employee handbook. This isn’t a commodity phish — it’s a toolkit-grade, multi-stage attack built specifically to defeat automated email scanners, security sandboxes, and network proxies. ...
A fresh Android malware sample masquerading as an RTO eChallan app. Two-stage dropper with NP Protect packer, SMS interception, USSD banking code execution, Firebase FCM C2, and only 11/66 VirusTotal detections.