protonMalware
Proton is a macOS backdoor focusing on data theft and credential access.From MITRE ATT&CK
Last reported 3 days ago, by Cisco Talos17 reports
ATT&CK techniques
6 of 37 · each with the sentence it comes from- T1684Social Engineering
“Once the victim moved from email to voice, the attacker could continue the scam through social engineering, payment manipulation, credential theft, or remote assistance fraud.”
- T1053.005Scheduled Task
“RedFlick uses scheduled tasks, jobs that Windows runs automatically, to install a backdoor named CosmicPulse.”
- T1218.002Control Panel
“The third uses control.exe, the Windows Control Panel program, to run the next stage from the C2 server.”
- T1012Query Registry
“…, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.”
- T1036Masquerading
“…ved an MSI installer creating a scheduled task that uses control.exe to download and execute a remotely hosted CosmicPulse downloader masquerading as a Control Panel applet (CPL).”
- T1057Process Discovery
“Once running with elevated privileges, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
17 reports, newest first · the exact sentence from each-
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers“The message also passed through forwarding and re-encapsulation paths, including Proton Mail, Microsoft 365, and downstream enterprise mail infrastructure.”
-
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government“The group’s servers were also being reached from those VPN addresses, which Proton typically assigns based on geographic proximity.”
-
Week in review: FortiBleed is still active, Patch Tuesday forecast“SimpleLogin is an email alias service from Proton that forwards messages to an existing mailbox.”
-
Product showcase: SimpleLogin keeps your email address private with aliases“SimpleLogin is an email alias service from Proton that forwards messages to an existing mailbox.”
-
Spokane Man Accused of Running Dark Web Cocaine Operation Through U.S. Mail“A forum post also encouraged customers to contact the vendor directly through a Proton Mail address allegedly registered to Nabi.”
-
Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited“Product showcase: Proton Drive end-to-end encrypted cloud storage”
-
Product showcase: Proton Drive end-to-end encrypted cloud storage“Product showcase: Proton Drive end-to-end encrypted cloud storage”
-
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor“Before, the group mostly used free email services such as Proton and Microsoft consumer accounts.”
-
Star Blizzard refines phishing and malware delivery with the RedFlick technique“Star Blizzard also continues using email from free providers such as Proton @proton.me, particularly in Evilginx spear-phishing operations observed throughout 2026.”
-
Dark Web Profile: Blue Locker Ransomware“However, attribution remains vague due to competing analyses linking the malware to the Iranian-associated Proton ransomware family on one hand and to an open-source project called MemeCryptor on the other.”
-
July 2026 Threat Trend Report on APT Groups“Larva-25001 deployed SpyGlace through Proton Drive, malicious RAR and LNK files, and a chain involving mshta.Exe and git.Exe.”
-
Update on Attacks by Threat Group APT-C-60 in 2026“In the case we observed, the spear-phishing email contained a Proton Drive link, which was used to lure the victim into downloading a RAR file from Proton Drive.”
-
French NGO reporters without borders targeted by Calisto“It is worth mentioning that Proton Security is very cooperative regarding this kind of spear phishing operations that impersonate real persons belonging to NGOs.”
-
Disrupting Attacks on Endpoints | Attack Disruption Engine“Figure 1: Timeline of events where Proton ransomware was deployed”
-
Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)“…stingly, the Zoho Assist agent was configured for unattended access, registering the compromised host to a Zoho Assist account tied to a Proton Mail address, [email redacted].”
-
What Is a Combolist? How It Works, Risks, and Prevention“By domains of email addresses, for example: Gmail, Yahoo, Proton, etc.”
-
Google Workspace Attack Surface“… our custom email route by sending [email redacted] an email from a separate email (We created a random email account with Proton), that is private and discusses private details about new Paleo-DNA.”
Indicators in its reports
named in the reports above- protonmail[.]comin 2 reports
- 103.160.59[.]97in 2 reports
- secure-dns-hub[.]comin 2 reports
- fbijobs[.]govin 1 report
- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiin 1 report
- account.simpleasip[.]orgin 1 report
- scorelikelygateway.simleasip[.]orgin 1 report
- hxxps://account.proton[.]me/assets/static/public-index.7162a3fd.jsin 1 report
- 196.44.117[.]196in 1 report
- hxxps://admin.artemood[.]com/vendor/plugx/*.phpin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.