FishMonger’s arsenal upgraded: SprySOCKS for Windows
2026-06-17T08:51:43Z•22dd590a4a4901de0799fcbc1727ae800ea988a9553a41d44bcb52da815c3d4e
APTAndroid-RATBTMOBCallPhantomEDR-killersEvilTokensFishMongerFrostyNeighborGopherWhisperNGateOAuth-abuseOceanLotusScarCruftSednitSprySOCKSWebwormaccount-takeoverbackdoorkernel-driverphishing-kitstealthsupply-chain-attack","ransomware","scams","AI-zero-daytoken-thefttrojanized-appvulnerable-drivers
What happened
ESET’s WeLiveSecurity feed (Jun 2026) highlights multiple high-risk threats and APT activity: researchers discovered SprySOCKS for Windows — a FishMonger backdoor that weaponizes a kernel driver for enhanced stealth; a new phishing kit dubbed EvilTokens that subverts Microsoft’s authentication flow to enable account takeover without stealing passwords; and an operational shift by OceanLotus toward domestic targeting. Additional coverage details numerous APT campaigns and malware families (Webworm, FrostyNeighbor, GopherWhisper, ScarCruft, Sednit), mobile threats (BTMOB Android RAT, trojanized/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- eset_welivesecurity
- Record identifier
- 22dd590a4a4901de0799fcbc1727ae800ea988a9553a41d44bcb52da815c3d4e
- Enrichment time
- 2026-06-17T08:51:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.