TA585 Deploys Novel Web-Injection to Deliver MonsterV2 Malware on Windows

According to GBHackers, the article discusses TA585, described as a recently emerged threat group that deploys a novel web-injection to deliver MonsterV2 malware on Windows. MonsterV2 is characterised as a remote access trojan, loader and info-stealer with capabilities including data exfiltration and remote desktop access (HVNC), and it can execute arbitrary commands while maintaining persistence.

The malware first appeared in cybercriminal forums in February 2025, and Proofpoint observed the campaign’s revival in February 2025 with government-themed phishing emails that mimicked IRS and SBA notifications, leading victims to booby-trapped PDFs. In April and May 2025, TA585 scaled operations using unique JavaScript web injects on legitimate but compromised sites, with a selective CAPTCHA-based lure prompting PowerShell execution to fetch and install MonsterV2.

The standard MaaS price for MonsterV2 is reportedly $800 per month, rising to $2,000 for enterprise capabilities, and TA585 handles its delivery infrastructure in-house rather than outsourcing to traffic distribution networks or initial access brokers.