Google links new LostKeys data theft malware to Russian cyberspies

Since early 2024, the Russian state-backed ColdRiver group has deployed a new VBS data-stealer called LostKeys in highly selective ClickFix social‑engineering attacks that trick targets into running PowerShell scripts; the malware exfiltrates files, system information, and running processes from Western governments, journalists, think tanks, NGOs and other high‑value targets, prompting alerts from Google Threat Intelligence, Five Eyes agencies, and U.S. sanctions and indictments.