Cybersecurity researchers have disclosed a malware campaign that uses fake software installers masquerading as popular tools like LetsVPN and QQ Browser to deliver the Winos 4.0 framework.

The campaign, first detected by Rapid7 in February 2025, involves the use of a multi-stage, memory-resident loader called Catena.

“Catena uses embedded shellcode and configuration switching logic to stage payloads like Winos 4.0 entirely in memory, evading traditional antivirus tools,” security researchers Anna Širokova and Ivan Feigl said. “Once installed, it quietly connects to attacker-controlled servers – mostly hosted in Hong Kong – to receive follow-up instructions or additional malware.”

DoJ disrupts DanaBot malware after 300K infections and $50M damage; 16 charged in Russia-linked cybercrime ring.

Latrodectus malware evades detection with ClickFix technique; TikTok and fake Ledger apps expand threat reach.

The problem? The file was unencrypted. No password protection. No security. Just a plain text file with millions of sensitive pieces of data.

Based on his analysis, Fowler determined the data was captured by some kind of infostealer malware. A popular tool used by cybercriminals, an infostealer is designed to grab usernames, passwords, and other sensitive data from breached sites and servers. Once the criminals get their hands on the data, they can use it to launch their own attacks or peddle the information on the dark web.

After finding the database, Fowler contacted the hosting provider, which removed it from public access. Since the provider would not disclose the name of the file’s owner, Fowler said he didn’t know if the database was created legitimately and then accidentally exposed or intentionally used for malicious reasons.

Hazy Hawk hijacked CDC and Deloitte subdomains via DNS flaws, flooding users with scams and malware.

SK Telecom says that a recently disclosed cybersecurity incident in April, first occurred all the way back in 2022, ultimately exposing the USIM data of 27 million subscribers.

SK Telecom is the largest mobile network operator in South Korea, holding roughly half of the national market.

On April 19, 2025, the company detected malware on its networks and responded by isolating the equipment suspected of being hacked.