Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners
2026-04-02T13:24:10Z•99e58a2c068dcca84da5bc4cdcb2bd38fc108fe6a5f730b95e54cd16329c679d
AGEWHEEZEAnthropicAxiosCERT-UACVE-2026-3502CVE-2026-5281ChromeClaudeDarkSwordDeepLoadRATTrueConfUAC-bypassUNC1069VBSVertex-AIWhatsAppcredential-theft','Casbaneiro','AtlasCrosscryptominerdata-exfiltrationiOSnpmphishingsupply-chainzero-day
What happened
Multiple active campaigns and high-impact incidents were reported: a financially motivated operation (REF1695) used fake ISO installers to deploy RATs and crypto miners and monetize infections via CPA fraud; an Axios npm supply-chain compromise (malicious dependency in versions 1.14.1 and 0.30.4) was attributed to UNC1069 and delivers a cross-platform RAT; Google patched an actively exploited Chrome zero-day (CVE-2026-5281, use-after-free in Dawn) and TrueConf’s exploited zero-day (CVE-2026-3502) was linked to attacks on Southeast Asian government networks. Other notable items include WhatsApp
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 99e58a2c068dcca84da5bc4cdcb2bd38fc108fe6a5f730b95e54cd16329c679d
- Enrichment time
- 2026-04-02T13:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.