Exposing the Deception: Russian EFF Impersonators Behind Stealc & Pyramid C2

The report documents a financially motivated campaign targeting Albion Online players by impersonating the Electronic Frontier Foundation, hosting decoy PDFs in an exposed open directory and delivering a PowerShell-based loader that drops a Python payload (Stealc infostealer and Pyramid C2 clients); investigators recovered multiple C2 IPs, shared SSH-key infrastructure linking additional hosts, forum reports of phishing, and a collection of file hashes and network observables useful for detection and blocking.