Mustang Panda Launches PlugX RAT Campaign via Fake Browser Update

Mustang Panda is conducting an active campaign deploying the PlugX RAT using a fake browser updater and a multi-stage LNK/PowerShell loader that sideloads the malware through a legitimate G DATA antivirus binary; the malware beacons to a hard-coded C2 over HTTPS with layered encryption, and defenders are advised to monitor LNK/PowerShell activity, suspicious HTTPS connections, and implement application whitelisting and user education.