Armored Likho expands its cyber-espionage toolkit

In May 2026, researchers uncovered an Armored Likho cyber-espionage campaign targeting Russian individuals and organizations that uses Tauri-based fake donation apps to drop a Rust "Still Toolkit": Still Sync (Telegram session/data stealer) and Still Audio (voice-activated eavesdropper); the report documents the infection chain, technical implementation, C2 and dead-drop resolver mechanisms, victimology, infrastructure, attribution, and provides file hashes and domain IoCs.