RhadaManthys Stealer Spreading Via Google Ads: Key Insights

Cyble Research & Intelligence Labs describes an active Rhadamanthys info-stealer campaign that delivers a PyInstaller-based loader via spam email attachments and Google Ads–driven phishing sites; the malware performs anti-VM checks, injects a PE shellcode, drops and executes a DLL via rundll32, harvests system/browser credentials and crypto-wallet data, and exfiltrates to an active C2. The report includes MITRE ATT&CK mappings and multiple IOCs (SHA256 hashes and phishing domains) to support detection and mitigation.