Cybercriminals have discovered a new attack vector targeting the creative design community by exploiting Blender, a widely used open-source 3D modeling application.

Threat actors are uploading malicious files to popular asset platforms like CGTrader, containing embedded Python scripts that execute automatically when users open the files in Blender.

This sophisticated campaign, uncovered through ongoing threat investigations, demonstrates how attackers continue to adapt their tactics to compromise unsuspecting users across Windows, macOS, and Linux systems.

The operation has been active for at least six months and connects to previously identified Russian-linked campaigns that used similar evasion techniques and decoy documentation methods.

These malicious .blend files are weaponized to steal sensitive information from victim machines, including passwords, cryptocurrency wallets, and authentication credentials from multiple browsers and applications.

The threat represents a significant risk to the creative industry, where Blender’s free and powerful capabilities make it an essential tool for professionals and hobbyists alike.

Morphisec security researchers identified and tracked this campaign after analyzing the infection chain and command and control infrastructure.

The research revealed direct connections to StealC V2, a dangerous information-stealing malware that has become increasingly popular in underground criminal markets since its emergence in April 2025.

Understanding the Infection Mechanism

When users open a compromised .blend file with Blender’s Auto Run Python Scripts setting enabled, the embedded Rig_Ui.py script executes automatically.

The malware then fetches a PowerShell loader from remote servers controlled by the attackers. This loader downloads multiple archive files containing a fully functional Python environment preloaded with StealC V2 and additional stealing components.

The extracted files create hidden shortcut files (LNK) that are copied to the Windows Startup folder, ensuring the malware persists across system reboots.

The attack chain involves multiple stages of obfuscation and uses encrypted communication channels.

Python scripts download encrypted payloads using ChaCha20 encryption through the Pyramid command and control infrastructure, making detection and analysis significantly more challenging.

StealC V2 itself targets over 23 web browsers, more than 100 browser extensions, 15 desktop cryptocurrency wallets, messaging applications like Telegram and Discord, and VPN clients.

The malware includes updated privilege escalation techniques and maintains low detection rates on security analysis platforms, allowing it to evade traditional security solutions.

Users should disable Blender’s Auto Run feature for untrusted file sources and exercise caution when downloading 3D models from community platforms.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Leverage Blender Foundation Files to Deliver Notorious StealC V2 Infostealer appeared first on Cyber Security News.

The 2025 Black Friday shopping season has become a prime hunting ground for cybercriminals, with threat actors recording over 2 million phishing attacks targeting online gamers and shoppers worldwide.

As global e-commerce continues to grow at 7-9% annually, attackers have adapted their tactics to exploit the seasonal rush, reduced user vigilance, and high-demand retail periods.

This year, the gaming industry emerged as a particularly lucrative target, with attackers launching campaigns disguised as popular platforms like Discord and Steam. The attack landscape in 2025 reveals a significant shift in targeting priorities.

From January through October, nearly 6.4 million phishing attempts were blocked across online stores, payment systems, and banks. Among all these, 48.2% targeted online shoppers directly, a sharp increase from 37.5% in 2024.

The first two weeks of November alone saw over 146,000 Black Friday-themed spam messages detected, with attackers impersonating major brands including Amazon, which accounted for 606,369 blocked phishing attempts.

Securelist security analysts identified that gaming platforms experienced an unprecedented surge in malicious activity, with over 20 million attack attempts recorded in 2025.

Discord-related attacks skyrocketed more than 14 times compared to the previous year, reaching 18.5 million attempted attacks.

This dramatic increase correlates with platform restrictions introduced in late 2024, which pushed users toward unofficial clients and proxy tools, thereby expanding the attack surface for threat actors distributing fake installers and malicious updates.

Gaming Platform Exploitation Tactics

The technical analysis of these campaigns reveals sophisticated delivery mechanisms. Attackers primarily distributed RiskTool variants, accounting for 17.8 million detections.

These tools hide files and mask processes, enabling persistent abuse, including covert crypto-mining operations.

Downloaders ranked second with 1.3 million detections, often embedded in unofficial patches or cracked game clients.

Banking Trojans also remained active throughout the season, with over 1.09 million attacks recorded globally.

These trojans employ web injection and form-grabbing techniques to capture login credentials when users visit targeted checkout pages during transactions.

The scam pages follow consistent patterns, featuring countdown timers, urgency messaging, and polished layouts that mimic official promotions.

Once victims submit credentials or payment details, attackers gain full account access and can steal in-game assets or execute fraudulent transactions against unsuspecting users.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Exploiting Black Friday Shopping Hype – 2+ Million Attacks Recorded appeared first on Cyber Security News.