New Phishing Campaign Targets Oil & Gas with Evolved Data-Stealing Malware

An updated Rhadamanthys information‑stealer is being distributed via targeted phishing campaigns against the oil and gas sector: emails employ a vehicle-incident lure and an open-redirect to present an image that, when clicked, downloads a ZIP containing the C++ stealer which contacts command-and-control servers to exfiltrate sensitive data. The report links this activity to broader stealer trends (Agent Tesla, Sync-Scheduler, Mighty Stealer), describes delivery and obfuscation techniques (RoundCube webmail, PDF/image lure), and notes historical bundling with LockBit payloads, indicating ongoing evolution and active exploitation.