MetaStealer Malware Targets US Asylum Seekers

Cyble Research and Intelligence Labs discovered a ZIP-based campaign distributing MetaStealer: a shortcut LNK masquerading as a PDF extracts and runs a bundled VPN executable that sideloads a malicious libcrypto DLL, which drops an MSI that unpacks a CAB containing MetaStealer. The installer also launches a legitimate-looking I-589 PDF to deceive victims while the stealer collects browser credentials and system data and communicates with C2 domains (ykqmwgsuummieaug.xyz, kiyaqoimsiieeyqa.xyz) over HTTP(S); the report provides IOCs, MITRE mappings, and mitigation recommendations.