Lifeboat Foundation

The campaign is unique for its focus on the Chinese-speaking demographic and the use of software-related lures to activate the attack chain.

“Equally striking is the attackers’ sophisticated use of legitimate software as a delivery mechanism for malware, seamlessly blending malicious activities with seemingly benign applications,” Fishbein said.

“The adaptability of the PNGPlug loader further elevates the threat, as its modular design allows it to be tailored for multiple campaigns.”