Zscaler Threat Hunting discovered an SEO poisoning campaign using fake Chocolatey and Microsoft Activation Scripts (MAS) sites to deliver Armorsteal. The campaign deploys modules for remote access, cryptocurrency wallet theft, clipboard hijacking, and credential stealing. Read the entire technical analysis here: zscaler.com/blogs/security-r…

Zscaler ThreatLabz observed attackers exploiting Citrix CVE-2026-88771 to deliver a FreeBSD-based implant that we track as TimeSmuggler. @sansecio observed the same malware being distributed as part of the StyleSmuggler zero-day campaign. The backdoor is written in Rust and collects host information and supports the following commands: - interval_check: Reconfigures the C2 polling interval - system_check: Runs a system command - dl_ex: Downloads and executes a binary file - open_shell: Spawns an interactive reverse shell - uninstall: Removes itself, including its persistence mechanisms The interactive shell opens a direct WebSocket channel, but the main communication takes place using a NTP-like protocol over UDP port 123. The first 4 bytes of the communication are either an NTPv4 server or client header, depending on whether the malware is sending data or just polling the command-and-control server, but the rest of the package is sent as MessagePack chunks. The malware adds a crontab entry to gain persistence and renames itself to resemble legitimate processes such as chronyd, kworker, fc-cache, and gvfsd-user. In addition, TimeSmuggler includes string obfuscation. The obfuscation works by calculating a unique offset per string to locate the encoded string within the binary. Interestingly, the functions that calculate each string's offset have their control flow flattened (CFF). After the string's address is resolved, TimeSmuggler uses a set of inline decoding operations to obtain the final deobfuscated string. The decoding operations are different for each string, which makes the analysis more time consuming. IOCs below: SHA-256: 878bc868bdb23be276f1fab8a4418a35264439f3344ffaf9404414ab08744782 C2 NTP domain: ntp[.]reposync[.]to C2 WSS domain: reposync[.]to TimeSmuggler version number: 2.1.6 For more details on CVE-2026-88771, visit our blog: zscaler.com/blogs/security-r…

ThreatLabz analyzed infrastructure and tooling used by a threat actor that launched AI-assisted attacks with ARTEX. While initial reporting identified South Korean financial institutions as victims, our research revealed the targeting to be far more widespread across multiple industries and regions. Our investigation reveals the inner workings of the threat actor’s operations including how they used AI in these attacks for the following purposes: - Assigning research tasks to different AI models - Leveraging different models to review one another’s work - Maintaining persistent states so sessions could be resumed The threat actor’s requests for bulk personal and transaction data, alongside questions about selling stolen data, suggest the attacks were financially motivated. Explore our full findings: zscaler.com/blogs/security-r…

🦠 ThreatLabz has identified an x64 variant of GuLoader. The sample uses similar anti-analysis methods as GuLoader x86 samples. However, the following anti-analysis features have been added: - Huge stack frames in order to break IDA's decompilation. - Direct syscalls to call Windows native API functions. GuLoader chooses a different syscall address that is chosen randomly. - The registered Vectored Exception Handler (used to obfuscate the control flow) points to a location within NTDLL's memory region, making the exception-driven control flow appear legitimate. - Use of the Windows API function TrySubmitThreadpoolCallback to execute callbacks and avoid detection. Sample hash: dc5021a0e1d00fb1da9eef2b5d5ac3f9a5906e5c3c17470807c3845083ac5a6d Malicious Google Drive URL: hxxps://drive.google[.]com/uc?export=download&id=1Zynj-CzTxaYpQr5aniRGE5gUqs26k-t5