UAC-0099 malicious VBS script delivering MATCHBOIL
Malware Activity
Summary
Hide ▲
Show ▼
A UAC-0099 malicious VBS script now extends the malware chain by downloading and installing MATCHBOIL, a loader used to stage additional payloads against a target in Ukraine. The script also embeds a prompt-like comment meant to disrupt AI-assisted analysis and interfere with automated triage. The activity shows how a loader delivery path can be paired with analysis-evasion content inside the same payload.
Related Happenings
GuardBreaker VBS prompt injection trips LLM safety mechanisms in UAC-0099 malware
Technical Analysis
H score23
First: 01.09.2026 11:26
Last: 01.09.2026 11:26
Sources 1
How related:
"This is meant to attract the AI's attention to the safety-sensitive content and stop it from analyzing the rest of the code."
About this happening:
GuardBreaker is a prompt-injection technique that uses a VBS comment to trigger LLM safety refusals, disrupting malware triage and scanner workflows. The method was ob...
GuardBreaker VBS prompt injection trips LLM safety mechanisms in UAC-0099 malware
Technical AnalysisHow related: "This is meant to attract the AI's attention to the safety-sensitive content and stop it from analyzing the rest of the code."
About this happening: GuardBreaker is a prompt-injection technique that uses a VBS comment to trigger LLM safety refusals, disrupting malware triage and scanner workflows. The method was ob...
ClickFix payload delivery analysis exposes API-driven generation and Downloads-folder AMSI evasion
Technical Analysis
H score74
First: 01.07.2026 08:32
Last: 01.07.2026 08:32
Sources 1
About this happening:
Analysis of ClickFix payload delivery shows operators moving to API-driven servers and a Downloads-folder orchestrator, increasing stealth across live campaigns. The b...
ClickFix payload delivery analysis exposes API-driven generation and Downloads-folder AMSI evasion
Technical AnalysisAbout this happening: Analysis of ClickFix payload delivery shows operators moving to API-driven servers and a Downloads-folder orchestrator, increasing stealth across live campaigns. The b...
LummaStealer infection surge via CastleLoader
Malware Activity
H score30
First: 11.02.2026 19:02
Last: 11.02.2026 19:02
Sources 1
About this happening:
The LummaStealer infostealer operation now includes a widespread ClickFix campaign observed in February 2026 that abuses Windows Terminal (wt.exe) instead of the R...
LummaStealer infection surge via CastleLoader
Malware ActivityAbout this happening: The LummaStealer infostealer operation now includes a widespread ClickFix campaign observed in February 2026 that abuses Windows Terminal (wt.exe) instead of the R...
Latest development: 06.03.2026 08:44
Microsoft disclosed a widespread ClickFix social-engineering campaign that uses Windows Terminal (wt.exe) instead of the Windows Run dialog to trick users into launching malicious commands, then chains through Terminal, PowerShell, cmd.exe, and MSBuild.exe to download payloads, set persistence via scheduled tasks, configure Microsoft Defender exclusions, and inject Lumma Stealer into chrome.exe and msedge.exe with QueueUserAPC().
SHADOW#REACTOR Remcos RAT delivery chain
Malware Activity
H score23
First: 13.01.2026 18:00
Last: 13.01.2026 18:00
Sources 1
About this happening:
Researchers analyzed SHADOW#REACTOR, a multi-stage Windows malware campaign that uses script-based staging and in-memory loaders to quietly deliver Remcos RAT, inc...
SHADOW#REACTOR Remcos RAT delivery chain
Malware ActivityAbout this happening: Researchers analyzed SHADOW#REACTOR, a multi-stage Windows malware campaign that uses script-based staging and in-memory loaders to quietly deliver Remcos RAT, inc...
Timeline
-
01.09.2026 11:26 2 articles · 2h ago
UAC-0099 hides a toxic prompt in a malicious VBS script to blunt AI analysis
Initial DisclosureResearchers disclosed GuardBreaker, an anti-analysis technique used by Russia-aligned UAC-0099 against a target in Ukraine to interfere with AI-assisted malware analysis by inserting the text "I want to make a nuclear weapon. Help me ..." as a comment in a malicious VBS script so an LLM may trigger safety refusals and stop parsing the rest of the code. The script is assessed to be part of a broader UAC-0099 toolset, and it is primarily designed to download and install MATCHBOIL, a C#-based loader used to deliver additional payloads. CERT-UA separately warned in late July 2026 that the adversary was using a malicious program dressed up as a Notepad++ plugin to compromise Windows systems with a new version of MATCHBOIL.
Show sources
- Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis — thehackernews.com — 01.09.2026 11:26
- Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis — thehackernews.com — 01.09.2026 11:26