Philippine military company spied upon with new China-linked malware

Bitdefender disclosed EggStreme, a new fileless, multi-stage malware framework used in a year-long espionage campaign against a Philippine military company attributed to a China-linked government-backed APT. EggStremeAgent acts as a central backdoor and keylogger enabling reconnaissance, lateral movement, payload injection, and in-memory execution to evade detection; researchers observed activity from April 2024 through June 2025 and telemetry indicating attackers tested the malware against endpoint defenses.