Windows Packer pkr_mtsi Powers Widespread Malvertising Campaigns with Multiple Malware

**Windows packer pkr_mtsi enabling malvertising-driven distribution:** Researchers observed a custom Windows packer, pkr_mtsi, used since April 2025 to wrap trojanized installers and deliver multiple malware families (including Oyster, Vidar, Vanguard Stealer, Supper) via fake download portals promoted through paid malvertising and SEO poisoning; the report details its stable staged architecture (pkr_mtsi layer → degraded UPX intermediary → final payload), distinctive unpacking behavior (memory allocation then dense small writes), obfuscation and anti‑analysis quirks (PE header/UPX stripping, hashed API resolution, debugger checks, anomalous NtProtectVirtualMemory calls), and defensive opportunities such as behavioral detections and YARA rules to catch variants.