Kaspersky Details MovieReaper Malware Framework Distributed via Compromised Torrent Trackers
Kaspersky researchers have published a detailed analysis of MovieReaper, a previously unknown modular malware framework distributed through popular torrent trackers under the guise of films, games, and other media.
The campaign began after attackers compromised the itorrents repository in October 2025. Because many torrent sites rely on this repository, malicious files quickly spread to users worldwide, resulting in hundreds of infections across Europe, Asia, and Africa.
Instead of the expected media file, victims receive an executable such as the odyssey (2026) [1080p] [webrip] [5.1].exe. The file typically carries a long name and uses the icon of a legitimate application such as the VLC media player to appear trustworthy.
Upon execution, the malware contacts an initial command server to retrieve shellcode. It then queries the Solana blockchain for encoded data stored in a specific account; this data reveals the address of a second command-and-control server. The blockchain-based mechanism is designed to maintain operation even if parts of the infrastructure are blocked.
The second-stage payload bypasses Windows UAC to establish persistence. The final module provides 21 commands that allow remote operators to read, download, list, create, copy, rename, move, delete, and change permissions on files, create symbolic links, and generate image thumbnails for selective exfiltration before full file transfer. Additional modules can be deployed on demand.
Additional findings in the same report
The report also examines attacks by the NightEagle group against Russian corporate infrastructure and the PAYLOAD campaign, which uses Active Directory Group Policy objects to extort victim organizations.
Separate research covered in the publication describes the InjectEave attack that amplifies electromagnetic emissions from wired or wireless headphones to eavesdrop on audio up to 30 meters away, and the DDRop hardware attack that bypasses Intel TDX and AMD SEV-SNP memory protections in virtual machines. A zero-day privilege-escalation flaw in the radio module of Google Pixel smartphones has been patched, and two members of the TeamPCP cybercrime group were arrested in Australia after infiltration by the Google Threat Intelligence Group.
Related articles
MacSync Malware Evolves to Steal Cryptocurrency and Conceal Components in iCloud
Updated MacSync malware for macOS now arrives bundled with a stealer and backdoor, allowing attackers to harvest browser history, cookies, passwords, Telegram data, and cryptocurrency wallet details while maintaining persistent remote access. Discovered by Kaspersky researchers in September 2026, the new variant uses a multi-stage infection chain that begins with a fake application download, such as a document collaboration tool or crypto wallet. One component is delivered through a publicly shared iCloud calendar entry in ICS format, bypassing traditional loaders. After execution, MacSync requests administrator credentials, displays a fake macOS damage notification, and installs the stealer alongside a Finder-masquerading backdoor. The backdoor enables arbitrary code execution, file theft, browser extension installation, and replacement of the legitimate Ledger application with a malicious version to drain cryptocurrency funds. Users are advised to download software only from trusted sources and remain cautious of unexpected administrator password prompts.
Network Traffic Analysis Reveals 75% Malware Threats Over 10 Months of Monitoring
Positive Technologies analyzed anonymized data from PT Sandbox and PT Network Attack Discovery collected between October 2025 and July 2026. The study found that malicious software accounted for 75% of all detected threats in organizational network traffic. Information-stealing trojans made up 24% of malware samples, with 85% of those focused on credential theft. RATs, loaders, and ransomware each represented smaller but high-impact shares. Legacy vulnerabilities such as CVE-2017-0199 and CVE-2017-11882 remained active attack vectors. Activity from groups including MustangPanda, TA505, and APT37 was observed across finance, manufacturing, and government sectors.
HEAVYGRAM Spyware Uses Telegram Bots for Command and Control Against Iranian Targets
Researchers at Group-IB have published a detailed analysis of HEAVYGRAM, a spyware family that abuses the Telegram messaging platform as its command-and-control infrastructure. The malware family was first observed in the second half of 2023 and has since been linked with moderate confidence to the Handala Hack group. Instead of operating dedicated servers, the operators rely on Telegram bots, accounts, and groups to register infected hosts, receive commands, exfiltrate stolen data, and deliver additional payloads. Once active, HEAVYGRAM captures screenshots, records audio, harvests cached files, and steals data from Telegram Desktop installed on the victim machine. The campaign primarily targets Iranian journalists, dissidents, and individuals opposed to the Iranian government. Infection vectors include malicious files distributed via messengers, disguised as legitimate applications such as Pictory, KeePass, or Telegram-related tools, sometimes delivered as HTML applications or scripts.
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens in Brazil
Elastic Security Labs researchers have detailed the operations of the KREMLIN banking malware, tracked under the identifier REF9334, which targets Chrome and Edge browsers to harvest credentials and session tokens. The campaign focuses almost exclusively on Brazil, with 98 percent of the 1,515 identified infections located in the country and impersonating a dozen Brazilian banks. Infection begins with multi-stage JavaScript loaders disguised as banking documents, invoices, or corporate papers that require manual execution by the victim. The loaders then deploy C++ installers and malicious browser extensions that modify the Secure Preferences file, enable developer mode, and overwrite protection objects with forged metadata using a technique called Phantom Extension. Once active, the extension collects session tokens, cookies, sessionStorage and localStorage data, 15 days of browsing history, screenshots, open tab information, and full HTML of visited pages. The operation has run since May 2025 across seven distinct campaigns and began using Ethereum smart contracts for infrastructure on 19 May 2026.