Google issued ‘State-backed attack in progress’ warnings after spotting web hijack scheme

Google Threat Intelligence observed a targeted, likely state-backed campaign (attributed to UNC6384 / TEMP.Hex) that hijacked captive portals on compromised edge devices to serve a malicious, code-signed installer (AdobePlugins.exe) which retrieves an MSI and installs CANONSTAGER and the SOGU.SEC backdoor; victims included diplomats in Southeast Asia and other global entities, and Google released indicators and mitigation guidance.