Researchers at VirusTotal identified an active infostealer campaign observed between January 11 and January 15, 2026, distributing malicious ZIP archives that impersonate legitimate software installers, most commonly branded as Malwarebytes. The activity is part of VirusTotal’s new “Flash Hunting Findings” and is tracked using a consistent ZIP structure and a shared behavioral hash 4acaac53c8340a8c236c91e68244e6cb, which enabled clustering and identification of related samples.

The campaign relies on DLL sideloading, placing a malicious CoreMessaging.dll alongside a trusted executable within the ZIP archive. When the legitimate executable is launched, Windows loads the malicious DLL, which then drops and executes secondary stage payloads. Behavioral analysis shows that these follow-on payloads are primarily infostealers, designed to harvest credentials and cryptocurrency wallet data. Distinctive DLL metadata, unusual export names, and consistent secondary payload behavior provide reliable pivots for tracking additional variants.

Impact: This activity poses a risk to users who download software installers from untrusted or spoofed sources, as the malware leverages trusted executables to evade basic security controls. Successful execution can result in theft of credentials and crypto-related data, and may enable broader account compromise if harvested credentials are reused across systems or services. The use of widely recognized software branding increases the likelihood of user execution and delayed detection.

Recommendation: Recommendations include restricting execution of software installers from untrusted sources, monitoring for DLL sideloading behavior where nonstandard DLLs are loaded by trusted executables, and detecting execution chains where ZIP archives spawn legitimate EXEs that immediately load unsigned or suspicious DLLs. Security teams should also incorporate behavioral hashes and metadata-based hunting, rather than relying solely on filenames or static hashes, to identify related activity. User awareness efforts should reinforce downloading software only from official vendor sites and verifying installer authenticity before execution.

Researchers from Mandiant announced the public release of a comprehensive set of Net-NTLMv1 rainbow tables on January 15, 2026, aiming to demonstrate the continued risk posed by this long-deprecated authentication protocol. Despite being considered cryptographically broken for decades, Mandiant reports that Net-NTLMv1 remains in active use across customer environments, often due to legacy configurations and a lack of perceived urgency to migrate.

The released dataset significantly lowers the barrier to exploiting Net-NTLMv1 by enabling defenders or attackers to recover credential material in under 12 hours using consumer-grade hardware. If an attacker captures a Net-NTLMv1 hash without Extended Session Security, a known plaintext attack can be applied to recover the underlying password hash of an Active Directory user or computer account. In high-impact scenarios, attackers can coerce authentication from privileged systems such as domain controllers, recover the machine account hash, and use it to perform DCSync operations that compromise the broader domain.

Impact: Continued support for Net-NTLMv1 exposes organizations to trivial credential compromise and rapid privilege escalation, particularly in Active Directory environments. The availability of ready-to-use rainbow tables removes practical barriers that previously limited exploitation to specialized tooling or infrastructure. As a result, any environment that still permits Net-NTLMv1 authentication may be vulnerable to full domain compromise following hash capture, even without advanced attacker capabilities.

Recommendation: Organizations should review Mandiant’s release and assess whether Net-NTLMv1 is permitted anywhere in their environment. Critical recommendations include disabling Net-NTLMv1 by configuring systems to allow NTLMv2 only via local or group policy, and validating that these settings cannot be reverted by attackers with local administrative access. Teams should also monitor authentication logs for evidence of Net-NTLMv1 or LAN Manager usage, particularly Event ID 4624 where the authentication package indicates LM or NTLMv1. Where legacy dependencies exist, remediation plans should be prioritized, as the risk of credential compromise and domain escalation now carries a substantially lower barrier.

Researchers at Unit 42 analyzed a real world incident in which attackers redirected employee paychecks by manipulating identity recovery and payroll workflows through social engineering. The case shows how attackers bypassed technical controls by impersonating employees and exploiting human operated processes rather than deploying malware or exploiting software flaws.

The attacker initiated access via phone based social engineering, repeatedly contacting payroll, IT, and HR help desks to learn verification procedures and successfully request password resets and MFA re enrollment. Using publicly available information gathered from social platforms, the attacker authenticated to cloud identity services, including Azure Active Directory, established persistence by adding an external email as an authentication method, and modified direct deposit details across multiple employee accounts. The activity blended into normal operations until employees reported missing paychecks.

Impact: This incident resulted in unauthorized changes to payroll data and financial loss risk for affected employees, with the potential for broader identity compromise had the activity gone undetected longer. Because valid credentials and MFA appeared legitimate, the attacker avoided triggering many traditional security alerts. The case highlights how identity and help desk workflows can become high impact attack paths even in environments with strong technical controls.

Recommendation: Organizations should review Unit 42’s findings and evaluate identity recovery and help desk processes as critical security controls. Key recommendations include strengthening help desk verification procedures, limiting and auditing MFA reset and re enrollment actions, and enforcing separation of duties for identity and payroll changes. Identity systems should log and alert on changes to authentication methods, especially the addition of external email addresses or devices, and forward these logs to centralized monitoring platforms. Regular testing of social engineering scenarios, combined with user and help desk training, can help reduce the likelihood of successful impersonation attacks.