SmokeLoader, first seen on criminal forums in 2011, has evolved into a highly modular malware loader designed to deliver a variety of second-stage payloads, including trojans, ransomware, and credential stealers.

After Operation Endgame disrupted numerous campaigns in mid-2024, the loader reemerged in early 2025 as two distinct variants: version 2025 alpha and version 2025.

Both variants address previous performance bugs, enhance evasion capabilities, and expand the plugin framework that enables disparate malicious activities.

Zscaler researchers noted that these updates allow SmokeLoader to operate more stealthily and efficiently on compromised hosts.

Initially, SmokeLoader’s primary function was to inject a main module into Windows Explorer for persistent execution and beaconing to command-and-control (C2) servers.

The stager, responsible for this injection, previously lacked proper checks and would continually inject new copies of the module at ten-minute intervals, resulting in severe performance degradation.

Zscaler analysts identified that version 2025 alpha introduced a mutex check in the stager, terminating the injection process if the mutex already exists.

This mutex generation algorithm, which derives a random lowercase string based on the first four bytes of the bot ID, prevents repeated injections and conserves system resources.

Beyond loader stability, SmokeLoader’s plugin framework has matured significantly. Operators can optionally deploy modules that harvest browser credentials, hijack sessions, perform distributed denial-of-service (DoS) attacks, and mine cryptocurrency.

Each plugin is delivered as a second-stage payload, triggered based on configuration flags received from the C2.

This flexibility allows threat actors to tailor payloads to specific objectives, from data exfiltration in targeted espionage to volumetric DoS in extortion campaigns.

Infection Mechanism and Persistence

SmokeLoader’s infection chain begins with a reconnaissance email or exploit kit that delivers the stager as a shellcode-packed executable.

Upon execution, the stager resolves Windows API dependencies by hash, decrypts code blocks with a hardcoded offset, and injects the main module into the explorer.exe process using 64-bit shellcode.

Once inside explorer.exe, the main module creates a scheduled task for persistence, now named “MicrosoftEdgeUpdateTaskMachine%hs,” where the placeholder is the first 16 characters of the bot ID.

This contrasts with earlier variants that used “Firefox Default Browser Agent %hs,” evidencing the author’s attempt to masquerade as legitimate update services.

After establishing persistence, the main module generates the same mutex to avoid duplicate execution and begins beaconing to C2 servers using an updated protocol that includes a four-byte CRC32 checksum.

This checksum is calculated over the payload starting at offset six, ensuring integrity and hindering simplistic network detections.

The response handling also changed: the initial four-byte command length field is now XOR-obfuscated with the RC4 key, complicating static signature matching.

Throughout this process, Zscaler analysts observed that SmokeLoader’s network communications consistently mimic legitimate browser user agents and TLS handshakes, further blending malicious traffic with normal web browsing.

By integrating both stager and main-module enhancements along with versatile plugins, SmokeLoader remains a potent threat for data theft and DoS operations under a single, adaptable framework.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post SmokeLoader Utilizes Optional Plugins To Perform Tasks Such as Stealing Data and DoS Attacks appeared first on Cyber Security News.

Since early 2025, the cybersecurity community has witnessed an unprecedented surge in distributed denial-of-service (DDoS) bandwidth, culminating in a record-shattering 11.5 Tbps assault attributed to a botnet named AISURU.

Emerging from XLab’s continuous monitoring of global DDoS incidents, this botnet leveraged compromised router firmware to amass approximately 300,000 active devices worldwide.

Researchers first detected unusual spikes of malicious traffic targeting major infrastructure providers, prompting deeper investigation into the underlying threat.

XLab analysts noted striking similarities between AISURU’s attack methodology and earlier campaigns, yet the scale and sophistication of this operation far surpassed previous benchmarks.

Propagation of AISURU began in April 2025 when threat actors exploited a vulnerability in Totolink router firmware update servers.

By altering the firmware URL to point to a malicious script, every device performing an automatic update became infected.

In a matter of weeks, the size of AISURU’s network swelled to over 100,000 routers, and by September 2025, the botnet had consolidated around 300,000 nodes.

XLab researchers identified the use of GRE tunneling to distribute traffic loads across multiple command-and-control (C2) servers, enabling the botnet to orchestrate a simultaneous flood of packets that overwhelmed target networks with ease.

The impact of the 11.5 Tbps attack was felt globally as service providers scrambled to mitigate the flood of SYN, UDP, and DNS amplification requests.

Affected organizations reported intermittent outages and service degradation, highlighting the potency of combining large-scale IoT compromise with advanced evasion techniques.

XLab analysts identified the rapid shift from traditional amplification vectors to custom-crafted packet sequences designed to bypass legacy mitigation tools, an innovation that allowed AISURU to set new world records in DDoS throughput.

While AISURU’s distributed architecture and bandwidth capacity are staggering on their own, the malware’s underlying behavior reveals a deeper level of technical refinement.

Its dual-version propagation engine demonstrates continuous evolution, integrating both zero-day exploits and known N-day vulnerabilities to expand its reach.

Equally concerning is its modular design, which facilitates swift updates to encryption, communication protocols, and attack commands without requiring a complete overhaul of the malware codebase.

Infection Mechanism: Firmware Update Hijacking

Delving into AISURU’s infection mechanism uncovers a deceptively simple yet devastating approach.

In April 2025, attackers breached Totolink’s firmware update server, planting a shell script named t.sh that redirected devices to download the AISURU payload.

Once executed, the script set up persistent execution by modifying /etc/rc.local entries and disabling the Linux OOM Killer via /proc/self/oom_score_adj, ensuring the bot remained resident across reboots.

The payload binary, renamed to libcow.so, avoided detection by masquerading as a common system daemon such as telnetd or dhclient.

Upon initialization, AISURU performs environment checks to terminate itself under virtualized or analysis environments by scanning for virtualization artifacts and debugging tools.

It then establishes a secure channel with C2 servers via a custom AES-XOR hybrid protocol, exchanging commands that range from DDoS instructions to residential proxy assignments.

One illustrative snippet of the persistence routine follows:-

# Persistence setup in /etc/rc.local
echo "/usr/lib/libcow.so &" >> /etc/rc.local
chmod +x /usr/lib/libcow.so

This mechanism underscores the threat actors’ mastery over both traditional Linux administration and bespoke malware engineering, enabling AISURU to maintain dominance in the DDoS ecosystem.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post AISURU Botnet With 300,000 Hijacked Routers Behind The Recent Massive 11.5 Tbps DDoS Attack appeared first on Cyber Security News.

Since May 2025, a novel credential stealer dubbed Maranhão Stealer has emerged as a significant threat to users of pirated gaming software. Distributed through deceptive websites hosting cracked launchers and cheats, the malware leverages cloud-hosted platforms to deliver trojanized installers that appear innocuous.

Upon execution, the installer unpacks a Node.js–compiled binary encapsulated in an Inno Setup executable, initiating a silent infection process that avoids user detection while harvesting sensitive data.

In its initial campaigns, threat actors attracted victims with enticing download links such as DerelictSetup.zip, promising modified game content.

Behind the scenes, however, the Inno Setup wrapper drops several components, including updater.exe, crypto.key, and infoprocess.exe, into a hidden “Microsoft Updater” directory under %localappdata%\Programs.

Cyble analysts noted that the malware establishes persistence through Run registry keys and scheduled tasks immediately after deployment.

The impact of Maranhão Stealer extends beyond simple credential theft. By injecting a reflective DLL into browser processes, it bypasses security measures like AppBound encryption to exfiltrate stored passwords, cookies, and browsing history from Chrome, Edge, Brave, Opera, and other Chromium-based browsers.

Cyble researchers identified that the malware also targets cryptocurrency wallets—Electrum, Exodus, Coinomi, and more—making it a dual threat to both traditional account credentials and digital asset wallets.

In addition to credential harvesting, Maranhão Stealer conducts extensive system reconnaissance. It gathers hardware and network information via WMI queries such as wmic os get Caption and external API calls to ip-api.com/json, profiling the operating system, CPU, disk space, and geographic location of the infected host.

Screenshots captured through inline C# in PowerShell further augment the stolen intelligence, enabling threat actors to monitor user activity in real time.

Infection Mechanism

A closer examination of the infection mechanism reveals a multi-stage process designed for stealth and reliability.

Upon execution of the Inno Setup installer, the main payload (updater.exe) is launched in /VERYSILENT mode, suppressing any installation dialogs.

Persistence is immediately secured with a registry modification:-

reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v updater /t REG_SZ /d "C:\Users\<username>\AppData\Local\Programs\Microsoft Updater\Updater.exe" /f

Once the Run key is in place, the malware marks its directory and files with hidden and system attributes through attrib +h +s, ensuring they remain obscured from casual inspection.

The next phase involves spawning a helper process, infoprocess.exe, which injects a payload DLL directly into running browser processes.

Using low-level Windows APIs—NtAllocateVirtualMemory, NtWriteProcessMemory, and CreateThreadEx—the malicious module is mapped into the target’s memory space without touching the disk.

This reflective injection technique not only evades antivirus scans but also runs inside the context of legitimate browser executables, making detection even more challenging.

By combining social engineering, cloud-based distribution, and advanced injection tactics, Maranhão Stealer exemplifies the evolving sophistication of modern credential stealers.

Security teams should prioritize application control policies, endpoint monitoring for anomalous registry edits, and behavioral analysis to detect and block such stealthy threats in their early stages.

Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free

The post New Maranhão Stealer Via Pirated Software Leveraging Cloud-Hosted Platforms to Steal Login Credentials appeared first on Cyber Security News.