RhadamanthysMalware
According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines. At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion.From MISP Galaxy
Last reported 23 days ago, by ESET WeLiveSecurity (ES)8 reports
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1684Social Engineering
“ClickFix is a social engineering technique that tricks end-users into pasting and running a malicious command.”
- T1036Masquerading
“The masquerading themes we’ve observed include installers for Chrome, Brave, Edge, Grammarly, and WebEx to highlight a few.”
- T1553.002Code Signing
“However, MSIX requires access to purchased or stolen code signing certificates making them viable to groups of above-average resources.”
- T1559.001Component Object Model
“To achieve this, the malware leverages COM (Component Object Model) objects as part of its technique.”
- T1016System Network Configuration Discovery
“T1016”
- T1027.007Dynamic API Resolution
“The list below includes DLL names for dynamic API resolution, User-Agent strings, WQL queries, registry paths, format strings, and EDR process names used for security product detection:”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“…tTesla, Formbook y SnakeStealer, coexistiendo con el avance de variantes modernas optimizadas para evasión como LummaStealer y Rhadamanthys.”
-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“…mo AgentTesla (0,95% nacional) y Formbook (0,26%), complementadas por la presencia de variantes evasivas modernas como LummaStealer y Rhadamanthys.”
-
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution“Rhadamanthys Stealer”
-
ClickFix tactic: The Phantom Meet Infostealer Campaign“The analysed cluster uses fake Google Meet pages to deliver Stealc, Rhadamanthys and, on macOS, AMOS Stealer.”
-
A New RAT and a Hands-on-Keyboard Intrusion“Over the years, Matanbuchus has been used to deliver a range of follow-on payloads, including Cobalt Strike, QakBot, DanaBot, Rhadamanthys stealer, and NetSupport RAT.”
-
Technical Analysis of Marco Stealer“Despite recent law enforcement actions that have taken aim at several information stealers such as Rhadamanthys and Lumma, the market for these malware tools remains significant.”
-
ClickFix Gets Creative: Malware Buried in Images“… malware execution chain, originating from a ClickFix lure, that leads to the delivery of infostealing malware, including LummaC2 and Rhadamanthys.”
-
GHOSTPULSE haunts victims using defense evasion bag o' tricks“We have observed SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport as final payloads.”
Indicators in its reports
named in the reports above- hxxp://217.156.50[.]228:8181/nujbOqrNYyLXXLmOhPpY/PNcWncSY.exein 1 report
- 217.156.50[.]228in 1 report
- hxxps://ipinfo[.]io/ipin 1 report
- hxxps://ipinfo[.]io/countryin 1 report
- hxxp://45.74.19[.]20:49259/receivein 1 report
- 45.74.19[.]20in 1 report
- 34deb6594098545d7ffb98844f0790bfin 1 report
- 3a3e8f6bc70748a39ffc047b3c86a665in 1 report
- 5eb91d1ad26c7eced894e34710aaa28ein 1 report
- 1042affb0ca6758ca0043112cdc7eda2in 1 report
- a98fa5fba55e470750ae74186c15fa73in 1 report
- 33dd8a5e234d911391cc8c301dc4a606in 1 report
- 49ab8d4c55b7f64eaba699ef0dc9054bin 1 report
- 661a5465d9a322276ebc414f39891a8bin 1 report
- 028604d6aa556de2ae4ca6b31e600677in 1 report
- 107.189.25[.]189in 1 report
- 1619bcad3785be31…3cb8964d4cb7in 1 report
- 5226ea8e0f516565…02c5b4ac6abdin 1 report
- dcf536edd67a9886…8af06cb036acin 1 report
- 66dbf939c00b09d8…f57b1ad047bdin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.