AllaKore RAT Malware Targeting Mexican Firms with Financial Fraud Tricks

A persistent, financially motivated spear-phishing campaign (active since at least 2021) targets large Mexican companies and financial/cryptocurrency platforms by delivering a modified AllaKore RAT via ZIP/MSI installers that verify Mexican geolocation; the RAT was enhanced to steal banking credentials, capture clipboard content, provide reverse shell access, and execute additional payloads. The report also notes unrelated research identifying three vulnerabilities (CVE-2024-0175/76/77) in Lamassu Douro bitcoin ATMs that previously allowed local attackers to execute arbitrary code via the update/QR mechanisms and have since been patched.