CoralRaider attacks use CDN cache to push info-stealer malware

Cisco Talos attributes an ongoing CoralRaider campaign to a financially motivated actor using CDN cache-hosted HTA/PowerShell chains delivered via malicious LNK archives to deploy info-stealers (Cryptbot, LummaC2, Rhadamanthys). The campaign uses obfuscation, Defender exclusion modifications, a FoDHelper UAC bypass, and targets victims across multiple countries to steal credentials, financial data, and account cookies.