MostereRAT phishing campaign targeting Japanese users
Campaign
Summary
Hide ▲
Show ▼
The MostereRAT phishing campaign is targeting Japanese users with business-inquiry lures, creating a path to data theft and remote control on compromised systems. Victims are pushed to click malicious links that lead to an infected site and a booby-trapped Word/ZIP payload that launches the malware. The operation uses EPL, mTLS-protected C2, and security-tool blocking to evade detection while dropping AnyDesk, TigerVNC, and TightVNC.
Related Happenings
OAuth device-code phishing campaign targeting SaaS accounts
Campaign
First: 04.04.2026 17:17
Last: 04.04.2026 17:17
Sources 1
About this happening:
A **device code phishing** campaign now includes **EvilTokens**, a **phishing-as-a-service** kit sold on **Telegram** that uses the **OAuth 2.0 device authorization flow** to hija...
OAuth device-code phishing campaign targeting SaaS accounts
CampaignAbout this happening: A **device code phishing** campaign now includes **EvilTokens**, a **phishing-as-a-service** kit sold on **Telegram** that uses the **OAuth 2.0 device authorization flow** to hija...
Compromised legitimate WordPress websites used to infect visitors with infostealer malware campaign expands across multiple victims
Campaign
First: 11.03.2026 16:45
Last: 11.03.2026 16:45
Sources 1
About this happening:
A **global ClickFix campaign** is abusing compromised **WordPress** sites to push **infostealer malware** to visitors, putting credentials and financial data at risk. The operatio...
Compromised legitimate WordPress websites used to infect visitors with infostealer malware campaign expands across multiple victims
CampaignAbout this happening: A **global ClickFix campaign** is abusing compromised **WordPress** sites to push **infostealer malware** to visitors, putting credentials and financial data at risk. The operatio...
Tomiris 2025 government-targeting campaign
Campaign
First: 01.12.2025 07:07
Last: 01.12.2025 07:07
Sources 1
About this happening:
The **Tomiris 2025 campaign** is using **phishing** and **public-service C2** to target **foreign ministries**, **intergovernmental organizations**, and **government entities**, i...
Tomiris 2025 government-targeting campaign
CampaignAbout this happening: The **Tomiris 2025 campaign** is using **phishing** and **public-service C2** to target **foreign ministries**, **intergovernmental organizations**, and **government entities**, i...
Sneaky 2FA BitB phishing activity
Malware Activity
First: 18.11.2025 20:31
Last: 18.11.2025 20:31
Sources 1
About this happening:
The **Sneaky 2FA** phishing kit has added **Browser-in-the-Browser (BitB)** pop-ups, making **credential theft** and **Microsoft account** takeover easier at scale. Attack chains...
Sneaky 2FA BitB phishing activity
Malware ActivityAbout this happening: The **Sneaky 2FA** phishing kit has added **Browser-in-the-Browser (BitB)** pop-ups, making **credential theft** and **Microsoft account** takeover easier at scale. Attack chains...
Quantum Route Redirect democratizes Microsoft 365 phishing tradecraft
Threat Actor Meta
First: 12.11.2025 17:48
Last: 12.11.2025 17:48
Sources 1
About this happening:
**Quantum Route Redirect** is **lowering the skill bar** for phishing operators, letting less-skilled cybercriminals run more sophisticated **Microsoft 365** credential-theft camp...
Quantum Route Redirect democratizes Microsoft 365 phishing tradecraft
Threat Actor MetaAbout this happening: **Quantum Route Redirect** is **lowering the skill bar** for phishing operators, letting less-skilled cybercriminals run more sophisticated **Microsoft 365** credential-theft camp...
Timeline
-
09.09.2025 13:27 2 articles · 8mo ago
MostereRAT phishing emails target Japanese users with business-inquiry lures
Initial DisclosureCybersecurity researchers disclosed a phishing campaign targeting Japanese users with business-inquiry lures that lead victims to a malicious site hosting a booby-trapped Microsoft Word file with an embedded ZIP archive. The ZIP contains an executable that launches MostereRAT, which drops tools such as AnyDesk, TigerVNC, and TightVNC, uses EPL-written modules, disables Windows security mechanisms, blocks traffic tied to security programs, and relies on mTLS-protected C2 to evade detection and extend control over compromised systems.
Show sources
- From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks — thehackernews.com — 09.09.2025 13:27
- From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks — thehackernews.com — 09.09.2025 13:27