Fake Copyright Claims Used to Spread AI-Enhanced Rhadamanthys Malware

Sophisticated Phishing Campaign Targets Global Organizations

A new phishing campaign dubbed CopyRh(ight)adamanthys has been uncovered, targeting organizations worldwide with fake copyright infringement claims. The campaign, active since July, aims to spread the latest version of the Rhadamanthys Stealer malware 1

1

Impersonation and AI-Enhanced Tactics

Cybercriminals are impersonating entertainment, media, and tech firms, which account for 70% of the spoofed organizations. The attackers use dedicated Gmail accounts and leverage AI capabilities to create convincing phishing emails and automate their attacks 1

1

Rhadamanthys Stealer: An Evolving Threat

The latest version of Rhadamanthys (0.7) claims to have advanced AI-driven features. However, researchers at Check Point Software have found that it primarily uses older machine learning techniques, particularly in optical character recognition (OCR) 2

2

Infection Process and Malware Capabilities

The phishing emails contain a password-protected ZIP archive with a decoy PDF, an executable, and a DLL. When executed, the malware is unpacked and deployed, capable of stealing sensitive information including:

1. Login credentials
2. Browser data
3. Cryptocurrency wallet details
4. Keystrokes 1

   1

   2

   2

Global Reach and Targeted Countries

The campaign has a wide reach, targeting organizations across multiple continents. Countries affected include the US, Israel, South Korea, Peru, Thailand, Spain, Switzerland, and Poland 2

2

Related Stories

Cybercriminals Exploit AI Hype to Spread Ransomware and Malware

Sophisticated Social Engineering Campaign Targets Crypto Users with Fake AI and Gaming Startups

Fake AI Image Generator Scam Spreads Malware, Targeting Content Creators and Businesses

Fake AI Tools Spread Noodlophile Malware, Targeting Crypto Wallets and Sensitive Data

Motivations and Attribution

Despite initial suspicions of state-sponsored activity, the indiscriminate targeting and financially motivated tactics suggest that lower-level criminals are behind the campaign. The attackers aim to profit either by directly siphoning funds from cryptocurrency wallets or by selling stolen credentials 2

2

Implications for Cybersecurity

Sergey Shykevich, threat intelligence group manager at Check Point Software, emphasized the need for security leaders to prioritize automation and AI in defense strategies to counteract these globally scaled, financially motivated phishing campaigns 2

2

As the threat landscape continues to evolve, organizations must remain vigilant and adapt their security measures to combat increasingly sophisticated attacks that leverage AI and automation techniques.