New Data-Stealing Poco RAT Campaign Targeting Spanish Speakers

A new email-based campaign distributes Poco RAT to Spanish-speaking victims by hiding malware in Google Drive-hosted archives and documents disguised as financial files; the RAT persists on infected hosts, injects into legitimate processes, communicates with a C2 ("94131119126" on ports 6541–6543), and has primarily targeted the mining sector while capable of stealing data or delivering additional malware.