Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution

McAfee Labs details a multi-stage malware campaign that leverages a malicious wextract.exe to unpack and execute successive payloads (cydn.exe → aydx.exe → mika.exe → vona.exe, etc.), disables Windows Defender via registry modifications, establishes persistence with scheduled tasks and ACL changes, and ultimately deploys Amadey components and RedLine Stealer to exfiltrate browser and wallet data; the report includes process flows, registry and ProcMon evidence, network C2 IPs, and SHA-256 IOCs for detection.