Google Advertising Used To Distribute RedLine Stealer
A malvertising campaign was discovered mimicking websites belonging to well-known software such as Notepad++ and Blender 3D to drop the RedLine information stealer.
An unregistered version of .NET Reactor was used to protect the loader malware from debuggers and multiple PowerShell commands were used to download the malware from an external location.
The payload was loaded directly into the memory of a process to avoid detection.
Featured Resources
View More Resources
blog
CVE-2026-32196: One-Click RCE via Windows Admin Center Control Flow Hijacking
Ilan Kalendarov, Security Research Team LeadBen Zamir, Security ResearcherElad Beber, Security ResearcherRuben Enkaoua, Security Researcher Cymulate Research Labs identified a set of
Webinar
Cymulate Stories: A Fireside Chat with Morgan Street Holdings
Many organizations still manage cyber risk using reactive security practices that struggle to keep pace with today’s threat landscape. As
blog
The Race to Ship AI Tools Left Security Behind. Part 1: Sandbox Escape
AI tools shipped fast - but weak sandboxing left escape paths, exposing systems to data access, abuse, and full compromise.