Fake Copyright Infringement Emails Spread Rhadamanthys

Check Point tracked a global spear-phishing campaign, CopyR(ight)hadamantys, that uses bespoke copyright-violation lures to trick recipients into downloading archives which deploy the Rhadamanthys infostealer via a malicious DLL. The stealer is modular and sophisticated — including an OCR component trained on Bitcoin wallet protection phrases and an evasion tactic that appends a large useless overlay to change file hashes and possibly evade antivirus — and the campaign has targeted hundreds of companies across multiple regions, with ties noted to known threat groups.