Social Engineering and Malware Campaigns Using Diverse Lures and Delivery Chains

Multiple reports describe distinct malware and intrusion campaigns active across enterprise, government, developer, and consumer targets, rather than a single shared incident. The activity includes vishing-led abuse of Quick Assist for remote access and persistence, a .NET AOT malware chain delivering Rhadamanthys and XMRig, renewed Horabot banking Trojan activity using fake CAPTCHA and mshta, a compromised Open VSX extension that fetched BlokTrooper payloads, and a Middle East-focused Ramadan coupon lure delivering a RAT with AWS S3-based exfiltration. Additional reporting covers Operation CamelClone, which used government-themed spear-phishing and LNK files to steal data with Rclone, and Contagious Trader, a cryptocurrency-focused campaign tied to malicious GitHub and npm projects.

One reference stands apart as vulnerability research rather than campaign reporting: watchTowr detailed pre-authenticated RCE chains in BMC FootPrints, which is a separate product security disclosure and not part of the malware operations described elsewhere. Because the references cover unrelated incidents, malware families, and victim sets, the material should not be treated as one cohesive event. It is also not fluff, as the sources contain substantive threat intelligence, technical analysis, exploit research, and incident tradecraft rather than marketing or generic advice.