Fully Autonomous Cybercrime: TA585 Uses ClickFix Phishing and Own Infrastructure to Deploy Premium MonsterV2 RAT

Proofpoint has identified a new cybercriminal threat actor, TA585, which operates with a high degree of independence across its attack chain, from infrastructure and delivery to payload deployment. The group was first detected in February 2025, using IRS-themed phishing emails with links to malicious PDFs, and victims were guided to manually execute a PowerShell command via the Run dialog to download MonsterV2.

By March 2025 TA585 impersonated the IRS and the SBA, targeting finance and accounting firms with small phishing waves, and by April 2025 it had evolved into a fully autonomous operator with its own infrastructure, CoreSecThree, hosting web injects and filtering to limit delivery to human targets. The campaign revolves around MonsterV2, a premium RAT, loader and stealer, described as expensive and used by only a small number of actors, including TA585.

MonsterV2 is coded in C++, Go and TypeScript and features ChaCha20 encryption for configuration and C2 communications, with capabilities such as credential and wallet theft, HVNC, keylogging and webcam access. Its operators reportedly avoid infecting CIS countries, while pricing lists the Standard version at $800 per month and the Enterprise tier at $2,000 per month.