Malicious PuTTY Ads Deliver OysterLoader, Allowing Attackers Full Device and Network Access

The Rhysida ransomware gang has been running a sophisticated malvertising campaign that delivers OysterLoader malware through deceptive search engine advertisements, giving attackers complete access to compromised devices and networks. The operation targets paid Bing search ads for software downloads such as PuTTY, Microsoft Teams and Zoom, directing users to counterfeit landing pages designed to coax victims into installing the malware.

OysterLoader acts as an initial access tool to establish a foothold and enables a persistent backdoor granting long‑term access to both the device and the broader network. The current campaign began in June 2025, marking a sharp escalation from the gang’s 2024 efforts, with the number of code‑signing certificates used in 2025 exceeding 40 compared with seven in the earlier campaign.

Enterprises should remain vigilant when downloading software, verify URLs carefully, and consider blocking malvertising through network controls, according to Expel which tracks certificate revocation associated with the campaign.