‘Speagle’ Malware Hijacks Security Software to Steal Missile Secrets

**Executive summary:** Researchers from Symantec and Carbon Black discovered Infostealer.Speagle, a stealthy 32-bit .NET infostealer that parasitically abuses the Cobra DocGuard document-protection infrastructure to collect and exfiltrate browser artifacts and targeted documents (including files related to Chinese ballistic missiles), sending encrypted data via compromised legitimate Cobra DocGuard servers; the malware operates in three phases and shows indicators consistent with a supply‑chain delivery and use of a Cobra DocGuard driver to self-delete, suggesting a highly targeted, high‑sophistication espionage campaign.