From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks

Cybersecurity researchers have detailed two linked campaigns that spotlight rising AI- and phishing-driven threats. The first centres on a phishing flow that delivers a stealthy banking Trojan-turned-remote access tool called MostereRAT, using EPL-coded staged payloads, mutual TLS for C2 communications, and plugins to extend functionality, with the malware able to disable Windows security tools and block a hard-coded list of security programmes.

The infection chain targets Japanese users with a Word document embedding a ZIP archive; inside is an executable that launches MostereRAT and drops tools such as AnyDesk, TigerVNC and TightVNC, while facilitating actions like registry edits, keystroke capture and RDP logins, and even creating a hidden administrator user; Fortinet FortiGuard Labs notes these techniques complicate detection and response and highlights the use of TrustedInstaller and other persistence methods.

A separate campaign mirrors these evasive techniques in a ClickFix-style delivery of MetaStealer, beginning with a fake Cloudflare Turnstile page and prompting users to click a verification step before a Windows File Explorer window triggers a chain that ends with an MSI payload.

The attackers also employ LNKs via the search-ms protocol to load a PDF-styled shortcut, and researchers from CloudSEK describe a PoC approach that uses CSS-based prompts to weaponise AI summarisers, a strategy they say could help deliver attacker-injected steps for ransomware. According to Fortinet FortiGuard Labs, these campaigns underscore how social engineering, automated payload chaining and AI-enabled tactics are expanding the risk landscape.