CoralRaider Malware Campaign Exploits CDN Cache to Spread Info-Stealers

Cisco Talos observed an ongoing global malware campaign (since at least Feb 2024) distributing three stealers—CryptBot, LummaC2, and Rhadamanthys—hosted on CDN cache domains and attributed with moderate confidence to the actor CoralRaider; the attack chain uses phishing links to ZIPs containing Windows shortcut (LNK) files that execute PowerShell to fetch an HTA which launches an embedded PowerShell loader employing the FoDHelper UAC bypass, ultimately installing stealers that harvest system/browser data, credentials, password manager and authenticator data, and cryptocurrency wallets.