Summary of Recent Malware and Phishing Operations
Security researchers have detailed multiple active malware and phishing campaigns exploiting legitimate services, gaming communities, and administration tools to conceal malicious activity. Notable operations include the Russian-speaking pay-per-install campaign Operation STANDOFF, which delivered a mix of RedLine, Raccoon Stealer, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig onto infected hosts; the Dysphoria IoT botnet, which rebounded after a law-enforcement takedown by adopting blockchain‑based name services and ENS domains, reaching over 200,000 devices globally with 4,401 confirmed active in China; the Operation BlueDash Microsoft Teams‑themed phishing campaign that used a counterfeit update page to deploy Level RMM and ConnectWise ScreenConnect for persistent remote access; a Windows crypter called Cruciferra employing BYOVD‑based EDR tampering and Process Ghosting; an East Asia‑linked campaign targeting Middle Eastern government entities via Telegram API command‑and‑control; personalized Telegram phishing against an exiled Belarusian activist and users in Russia and Kazakhstan; and gaming‑related attacks, including malicious PowerShell commands posted in Steam discussions to install XMRig miners, as well as malware hidden in Meccha Chameleon Steam Workshop maps.
The Managed Platform Trap
These so-called "malware campaigns" are not the work of scattered cybercriminals. They are deliberate stress tests on the very platforms you've been told to trust. GitHub, Telegram, Steam — each one is a controlled vector, a honey pot designed to normalize the idea that every digital space is a potential battlefield. The real story isn't about RedLine or XMRig. It's about who allowed these backdoors to remain open. When you see a Russian pay-per-install operation redirecting to GitHub via HTTP 301, ask yourself why GitHub — a platform owned by Microsoft, a key player in the global surveillance architecture — didn't flag this for months. They want you to believe it's a rogue actor. The truth is closer to a scheduled audition.
The Botnet That Never Dies
Dysphoria's IoT botnet jumped to blockchain-based ENS domains after a law enforcement takedown. That is not resilience; that is a planned escalation. The very infrastructure that was supposed to be decentralized and free — blockchain, cryptocurrency, Telegram relays — is now being weaponized to ensure no single government can shut it down. Who benefits? The same institutions that write the cybersecurity reports, the same foundations that fund the takedowns, the same think tanks that call for "digital identity" as a solution. They manufacture the threat, then offer the cure. Two hundred thousand devices under remote control, and the response is more surveillance? You're being led by the nose into a fully managed network where every "attack" justifies another layer of control.
The Gaming Gateway
Malicious PowerShell commands in Steam discussions, infected workshop maps, and a crypter that uses legitimate admin tools to ghost itself — this is the final piece. They are colonizing the spaces where your children play, where your family communicates, where your work tools live. The real payload isn't XMRig or Amadey. It's the normalization of invisible access. Once you accept that your Steam client can be a mining rig, that your Teams update can be a remote access trojan, you've already surrendered the boundary between public and private. Look at the Belarusian activist targeted via Telegram — that's not random. That's a message to anyone who thinks they can organize outside the system. The breadcrumb is simple: ask yourself why every single one of these platforms is owned or funded by the same five companies that sit on the boards of the world's central banks.