This week, CTI looks at a new Linux malware campaign that’s capable of bypassing antivirus detection. Next, CTI explains how cybercriminals are using the ClickFix tactic and fake CAPTCHA pages to deploy the CORNFLAKE.V3 backdoor. Finally, CTI investigates a new PRC-Nexus campaign that hijacks web traffic and delivers malware through fake browser update pages.
1. New Linux malware evades antivirus detection
A recent Trellix investigation uncovered a stealthy Linux malware campaign that uses malicious filenames to execute code without traditional files, bypassing most detection methods.
The final payload, a fileless backdoor called VShell, runs entirely in memory and grants attackers full remote access while masquerading as a legitimate system process.
Infection chain
The infection begins with a spam email containing a RAR archive attachment. The RAR archive includes a file whose filename contains Bash-compatible code that can execute commands when interpreted by the shell. The filename remains dormant until a script or command evaluates or expands the filename.
- Initial infection vector: The initial spam email includes an invitation for a beauty product survey, along with a monetary reward for those who complete it.
Trellix points out that the email doesn’t instruct the user to open the attached archive, yy.rar. Instead, the attacker hopes the recipient might mistake the attachment for something related to the survey. The extracted file has a specially crafted filename that triggers malicious behavior without the user interacting.
- Stage 1 – weaponized filename inside.rar: Trellix notes that this extracted file has an unusual name, and that you “cannot manually create a file with this name in the shell due to its special characters being interpreted as command syntax.” Trellix believes that the filename may have been created using a language like Python. It’s also possible that it was dropped using a tool or script that can bypass shell input validation. The decoded filename will establish a connection to the C2 server and download/execute a script for the second stage.
- Stage 2 – downloader script: The downloader script will check for writable directories in which it can drop and execute files, detect system architectures, grab the appropriate binary payload depending on that architecture, and perform a silent execution via nohup.
- Stage 3 payload – in-memory loader for VShell malware: After the stage 2 script determines the system’s architecture and grabs the corresponding binary, the rest of the infection is triggered. The binary will establish C2 communication by making an HTTP GET request to the server, receive the XOR-encrypted payload, and decrypt and execute the payload from memory. Trellix notes that it is renamed in-memory to appear as a legitimate Linux kernel thread. It will also ensure no other instances are running to avoid reinfection.
- Final payload – VShell malware: VShell malware tends to be used by Chinese APT groups. Some of its key features include reverse shell access, an ability to perform file operations, process management, port forwarding, and more.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The attackers behind the campaign likely have a high level of sophistication, given their advanced capabilities like architecture-aware payload delivery, in-memory execution, and clever obfuscation tactics.
As Trellix points out, this campaign highlights a dangerous evolution in Linux malware delivery. This is particularly important, with threat actors increasingly targeting Linux systems.
2. UNC5518 deploys CORNFLAKE.V3 using ClickFix and fake CAPTCHA pages
According to Mandiant, the threat actor UNC5518 is using the ClickFix technique to compromise websites, serve fake CAPTCHA verification pages, and deliver downloader scripts, enabling other actors to deploy the CORNFLAKE.V3 backdoor. The actors UNC5774 and UNC4108 have both been observed leveraging this access.
What is CORNFLAKE.V3?
CORNFLAKE.V3 is a stealthy, persistent malware written in JavaScript or PHP that executes remote payloads and uses Cloudflare Tunnels to evade detection. The malware will obtain payloads via HTTP including shell commands, executables, and DLLs.
Mandiant states that CORNFLAKE.V3 is simply an updated version of CORNFLAKE.V2, with the original CORNFLAKE malware differing the most from these most recent variants.
The malware will check to ensure that only one instance of the script is running at a time before starting to collect system information. It then sets the C2 server IP addresses and enters into a loop function. To establish persistence, the malware creates a Registry Run key named ChromeUpdater.
Mandiant observed the malware executing different types of payloads originating from its C2 server. One of these payloads was a batch script full of reconnaissance commands—specifically Active Directory commands. It will determine if the host is domain joined or not and carry out various reconnaissance steps based on that.
In addition, Mandiant observed a batch script that tries to harvest credentials via Kerberoasting—an attack that targets the Windows Active Directory by abusing the Kerberos authentication protocol.
PHP variant and executed payloads
Mandiant also observed a PHP variant of CORNFLAKE.V3 that is similar to previous iterations. This particular variant is dropped by an in-memory script, again using the ClickFix style technique.
This script downloads the PHP package, writes it to disk, and extracts it. Some of its executed payloads include one for active directory reconnaissance, and an additional backdoor implant called WINDYTWIST.SEA.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Mandiant’s analysis reveals the growing sophistication and acceleration of access-as-a-service models. UNC5518’s role as an initial access broker demonstrates how cybercriminal ecosystems are becoming more modular and efficient, allowing actors to collaborate and scale operations almost like legitimate organizations. This activity also uses popular tactics like ClickFix and fake CAPTCHA, and abuses legitimate infrastructure.
Mandiant’s report includes hunting queries that may be helpful in identifying related compromise within your environment.
3. PRC-Nexus campaign hijacks web traffic
In March, Google Threat Intelligence Group (GTIG) discovered a China-linked threat group UNC6384 conducting a sophisticated cyber espionage campaign targeting diplomats.
UNC6384 hijacked web traffic and delivered malware through fake browser update pages. The operation used techniques like adversary-in-the-middle (AitM) attacks, signed malware, and DLL side-loading to evade detection and maintain persistent access.
Campaign overview
Google found that all of the malware payloads in this campaign were disguised as software or plugin updates, and delivered via UNC6384 infrastructure via AitM and social engineering.
The target’s web browser will test if the internet connection is behind a captive portal, an AitM will redirect the browser to a site controlled by the actor, and malware is delivered in several stages.
Malware delivery
Google identified the actor using a captive portal hijack to deliver malware disguised as an Adobe plugin. As Google explains, a captive portal is “a network setup that directs users to a specific webpage, usually a login or splash page, before granting internet access.”
Google notes that all web browsers have this functionality. Their investigation revealed redirect chains from Google’s gstatic domain that led to the actor’s website for malware delivery.
Fake plugin update
The victim is redirected and tricked into believing they need a software update, subsequently downloading the malware that pretends to be a plugin update. The webpage itself appears to the victim as a legitimate software update site, uses an HTTP connection with a valid TLS cert, and the payload itself is digitally signed. If the victim clicks to install the update they will receive instructions for executing the download in a way that would bypass Windows security protections.
Malware analysis
- STATICPLUGIN downloader: The previously downloaded AdobePlugins.exe is the first stage malware downloader that is signed with a valid certificate. Google determined that the binary code was signed on May 9th, 2025, and is no longer active. This STATICPLUGIN downloader uses a custom TForm to pretend to be an installer for Microsoft Visual C++ 2013. After installing additional files, CANONSTAGER gets executed via DLL side loading.
- CANONSTAGER launcher: The purpose of CANONSTAGER is to execute the encrypted payload. This payload is called SOGU.SEC and is a variant of SOGU. The launcher uses custom API hashing and thread local storage, hides its launcher code in a custom window procedure, and deploys SOGU.SEC.
- SOGU.SEC backdoor: The SOGU malware is known to be leveraged by UNC6384. It can collect system information, upload and download files from its C2, and execute a remote command shell.
Analyst comments from Tanium’s Cyber Threat Intelligence team
Effective espionage doesn’t always require zero-day exploits. As this campaign demonstrates, threat actors also use strategies like social engineering, traffic hijacking, and living-off-the-land techniques to bypass defenses and achieve their objectives.
This attack chain, which relies heavily on browser behavior and a captive portal redirect, raises additional concerns for targets—especially those working in environments that aren’t as trusted, like hotels or conferences.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum and start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.