Threat actors are wrapping their tools in layers of obfuscation, and DOUBLELOADER is no exception. This new backdoor uses the ALCATRAZ obfuscator—once seen in the game-hacking scene—to disguise its presence. It reaches out to hardcoded IPs and paves the way for the RHADAMANTHYS infostealer.

In a campaign likely aimed at Chinese-speaking users, fake installers for QQ Browser and LetsVPN are being used to quietly deliver Winos 4.0. Behind the scenes, a memory-resident loader named Catena helps the malware dodge AV tools. Linked to the Silver Fox threat group, the payload uses reflective DLL injection to steal data and provide remote access.

A critical bug in D-Link routers could give attackers an easy way in. The flaw affects DIR-605L and DIR-816L models, exposing hardcoded Telnet credentials through the firmware. Once inside, attackers can run arbitrary commands, change configs, or pivot deeper into a network - all without needing to brute-force anything.

Top Malware Reported in the Last 24 Hours

DOUBLELOADER malware uses ALCATRAZ obfuscator

Elastic Security Labs identified a new malware family called DOUBLELOADER, which uses the ALCATRAZ obfuscator for evasion and pairs with the RHADAMANTHYS infostealer. DOUBLELOADER operates as a backdoor, injecting code into explorer.exe and communicating with a hardcoded IP address while collecting host information. The ALCATRAZ obfuscator, originally from the game-hacking scene, enables obfuscation of compiled binaries and has been adopted by threat actors for advanced malware techniques. DOUBLELOADER employs multiple obfuscation techniques such as entry point obfuscation, anti-disassembly, instruction mutation, constant unfolding, LEA obfuscation, and control flow flattening, making detection and analysis challenging.

Bumblebee spreads via Zenmap and WinMTR

Fake Zenmap and WinMRT websites are targeting IT staff with malware through SEO poisoning campaigns. These sites distribute trojanized installers for popular tools like Zenmap and WinMTR, which deliver the Bumblebee malware loader. The malware evades detection by most antivirus engines and can introduce additional threats such as ransomware and infostealers. The campaign also targets users of other software like WisenetViewer and Milestone XProtect. Official RVTools sites were taken offline due to DDoS attacks, possibly by the same threat actors to redirect users to malicious sites.

Hacker abuse NSIS, drop Winos 4.0

A malware campaign has been uncovered that uses fake software installers mimicking popular tools like LetsVPN and QQ Browser to deliver the Winos 4.0 malware framework. This operation employs a memory-resident loader named Catena to evade antivirus detection. The campaign targets Chinese-speaking environments and is linked to the threat actor Silver Fox. The malware, based on the Gh0st RAT, is capable of data harvesting, remote access, and DDoS attacks. The infection chain involves trojanized NSIS installers, reflective DLL injection, and communication with C2 servers.

Top Vulnerabilities Reported in the Last 24 Hours

Bugs in Tenable Network Monitor

Tenable has released version 6.5.1 of its Network Monitor to address multiple high-severity vulnerabilities in its codebase and third-party libraries, including OpenSSL, expat, curl, libpcap, and libxml2. Two critical local privilege escalation vulnerabilities (CVE-2025-24916 and CVE-2025-24917) have been resolved. CVE-2025-24916 involved insecure directory permissions during installation on non-default locations. CVE-2025-24917 allowed non-administrative users to execute arbitrary code with SYSTEM privileges. 

RCE flaw in D-Link routers

A critical vulnerability (CVE-2025-46176) in D-Link DIR-605L and DIR-816L routers exposes hardcoded Telnet credentials, enabling remote command execution. The flaw originates from improper command neutralization (CWE-77), allowing attackers to bypass authentication through firmware analysis. Researchers identified plaintext passwords in the firmware using tools like binwalk, exposing the routers to potential exploitation. Attackers can execute arbitrary commands, modify configurations, deploy malware, or pivot to internal networks via this vulnerability.