Venom Spider Spins Web of New Malware for MaaS Platform

Zscaler ThreatLabz observed Venom Spider (MaaS) campaigns from August–October delivering two new malware families: RevC2, a WebSocket-based backdoor that steals browser credentials/cookies, proxies traffic (SOCKS5), captures screenshots and enables RCE; and Venom Loader, which customizes and XOR-encodes payloads per victim using the machine name to deploy a JavaScript RCE backdoor (“More_eggs lite”). Researchers published IoCs, a Python WebSocket emulation script, and noted the platform’s likely continued enhancement and reuse by criminal groups.