SiMay RAT Spreads Via Telegram Phishing Site

A multi-stage malware campaign uses a phishing site masquerading as Telegram to deliver a trojanized MSI that drops a downloader which retrieves staged .dat files and compressed payloads from note.youdao.com; the campaign employs DLL side-loading, process injection, encrypted shellcode, and ultimately deploys a Gh0st RAT-like remote access trojan with keylogging and espionage capabilities, targeting Chinese-speaking users and reusing infrastructure/identifiers tied to a previously reported SiMay actor. IoCs (URLs, IP, and multiple file hashes) and recommended mitigations are provided.