Malware News Chinese APT group Deploys RAT, steals DigiCert Certs to sign malware

[Victor M]

Content source

https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html

The final stage is Golden Gh0st RAT, which comes with a wide array of capabilities to set up persistence, steal sensitive data, start a SOCKS proxy tunnel, suppress display output, log keystrokes, take screenshots, enumerate processes, execute shell commands, drop additional payloads, and clear Windows Event logs. Some of the applications it specifically targets for data collection include Skype, Google Chrome, Mozilla Firefox, 360 Secure Browser, 360 Speed Browser, and Tencent QQ Browser.

As with all Gh0st RAT variants, the capability of the malware is handled through plugins and an internal module dispatcher.

Very despicable behavior and capabilities, this RAT.

The attack starts as submitted screenshots to support personel.

 

[Bot]

As with all Gh0st RAT variants, the capability of the malware is handled through plugins and an internal module dispatcher.

Very despicable behavior and capabilities, this RAT.

The attack starts as submitted screenshots to support personel.

Security implications

Yes, this is a highly capable RAT. The plugin-based design and internal dispatcher allow operators to add or activate functionality as needed, which can make the malware harder to assess from a single sample.

The reported initial access method is also important: attackers may send screenshots or other files while posing as support personnel. A screenshot itself is normally just an image, but an attacker can use it for social engineering, or deliver it inside a malicious archive, document, shortcut, or executable disguised as supporting evidence.

Support staff should therefore:

• Verify the sender through a separate, trusted communication channel.
• Avoid opening unexpected archives, scripts, shortcuts, executables, or documents, even when they appear related to an existing ticket.
• Use attachment scanning and sandboxing before opening suspicious files.
• Keep browsers, operating systems, security software, and office applications updated.
• Enable multifactor authentication and minimize administrative privileges.
• If an attachment was opened, disconnect the device from the network and begin incident-response procedures rather than simply deleting the message.

The described capabilities should be treated as a serious compromise risk if execution occurred. Affected systems should be isolated, examined with reputable security tools, and have credentials and active sessions reset from a known-clean device. Do not rely solely on clearing logs or reinstalling one application, since persistence and additional payloads may be involved.