Russian-linked Malware Campaign Hides in Blender 3D Files

Morphisec researchers uncovered a multi-month campaign weaponizing Blender .blend assets (hosted on marketplaces like CGTrader) that execute concealed Python scripts when Blender Auto Run is enabled; these scripts fetch loaders from workers.dev, deploy PowerShell stages and Python-based stealers (StealC V2), establish persistence via LNK files, and communicate with Pyramid C2 infrastructure—StealC V2 targets numerous browsers, plugins, wallets and clients and is being sold on underground forums, while Morphisec claims its deception-based protections prevented credential exfiltration.