Vampire Bot Go malware activity
Malware Activity
Summary
Hide ▲
Show ▼
BatShadow, a Vietnam-based threat group, is using phishing emails and ZIP archives to target job seekers and digital marketing professionals with Vampire Bot malware. The Go-based malware is built for continuous desktop surveillance, screenshots, and data theft, and it also checks in with a C2 server to receive commands and additional payloads. Aryaka said the campaign uses job-application lures to blend malicious activity into normal-looking workflow traffic.
Related Happenings
JustAskJacky fake AI assistant malware campaign
Campaign
H score33
First: 04.06.2026 17:00
Last: 04.06.2026 17:00
Sources 1
About this happening:
The **JustAskJacky** campaign is distributing a fake **AI assistant** that installs a **backdoor**, turning trusted-looking software into a malware delivery path. The operation us...
JustAskJacky fake AI assistant malware campaign
CampaignAbout this happening: The **JustAskJacky** campaign is distributing a fake **AI assistant** that installs a **backdoor**, turning trusted-looking software into a malware delivery path. The operation us...
GreyVibe custom malware activity with LegionRelay, PhantomRelay, and FallSpy
Malware Activity
H score41
First: 29.05.2026 01:24
Last: 29.05.2026 01:24
Sources 1
About this happening:
**GREYVIBE** is a **Russian-speaking** malware activity targeting **Ukraine and Ukraine-related entities** since at least **August 2025**. The group uses **spear-phishing e-mails*...
GreyVibe custom malware activity with LegionRelay, PhantomRelay, and FallSpy
Malware ActivityAbout this happening: **GREYVIBE** is a **Russian-speaking** malware activity targeting **Ukraine and Ukraine-related entities** since at least **August 2025**. The group uses **spear-phishing e-mails*...
Webworm EchoCreep and GraphWorm backdoor expansion
Malware Activity
H score28
First: 20.05.2026 15:51
Last: 20.05.2026 15:51
Sources 1
About this happening:
**Webworm** expanded its malware arsenal in **2025** with the custom backdoors **EchoCreep** and **GraphWorm**, increasing its ability to run stealthy **command-and-control** oper...
Webworm EchoCreep and GraphWorm backdoor expansion
Malware ActivityAbout this happening: **Webworm** expanded its malware arsenal in **2025** with the custom backdoors **EchoCreep** and **GraphWorm**, increasing its ability to run stealthy **command-and-control** oper...
TCLBANKER banking trojan activity targeting 59 financial platforms
Malware Activity
H score16
First: 08.05.2026 21:12
Last: 08.05.2026 21:12
Sources 1
About this happening:
**TCLBANKER** is a newly documented **Brazilian banking trojan** that can hit **59 banking, fintech, and cryptocurrency platforms**, increasing the risk of credential theft and re...
TCLBANKER banking trojan activity targeting 59 financial platforms
Malware ActivityAbout this happening: **TCLBANKER** is a newly documented **Brazilian banking trojan** that can hit **59 banking, fintech, and cryptocurrency platforms**, increasing the risk of credential theft and re...
Vidar infostealer market rise and distribution expansion
Malware Activity
H score33
First: 28.04.2026 22:07
Last: 28.04.2026 22:07
Sources 1
About this happening:
**Vidar** remains a long-running **infostealer** threat, and **Aryaka** reported a fresh campaign in **recent weeks** that adds **new obfuscation techniques** and stronger **steal...
Vidar infostealer market rise and distribution expansion
Malware ActivityAbout this happening: **Vidar** remains a long-running **infostealer** threat, and **Aryaka** reported a fresh campaign in **recent weeks** that adds **new obfuscation techniques** and stronger **steal...
Timeline
-
07.10.2025 20:04 3 articles · 8mo ago
BatShadow delivers Vampire Bot through fake job documents
Initial DisclosureBatShadow, described as a Vietnamese threat actor, uses recruiter impersonation and booby-trapped job documents to push job seekers and digital marketing professionals toward a Go-based malware called Vampire Bot. The delivery chain uses ZIP archives, malicious LNK files, PowerShell, fake Microsoft Edge download prompts, and a disguised payload such as Marriott_Marketing_Job_Description.pdf.exe; once installed, the malware can profile the host, steal information, capture screenshots, and contact api3.samsungcareers[.]work for commands or additional payloads.
Show sources
- BatShadow Group Uses New Go-Based 'Vampire Bot' Malware to Hunt Job Seekers — thehackernews.com — 07.10.2025 20:04
- BatShadow Group Uses New Go-Based 'Vampire Bot' Malware to Hunt Job Seekers — thehackernews.com — 07.10.2025 20:04
- Vampire Bot Malware Sinks Fangs Into Job Hunters — www.darkreading.com — 09.10.2025 00:02