• Delivery: in 2025, macro-enabled .xlsm lures themed as fines or taxes, sometimes sent from a compromised local-government mailbox, with the payload base64-encoded in spreadsheet cells and dropped into %ProgramData%. Since early 2026, RAR archives exploiting CVE-2025-8088 show a decoy PDF while writing a LNK into the Startup folder plus an encrypted payload and a PowerShell loader in %ProgramData%.
• BeautyStealer (v0.9–2.0): takes Chrome, Edge, Opera and Firefox cookies, passwords and Local State; OpenVPN configs; and files from Desktop, Documents, Downloads, removable media and mapped drives, including .kdbx, .jks, .pfx, .rdp, .ovpn and .zs2 (Ukrainian qualified e-signature keys). It exfiltrates to a Telegram chat via sendDocument or, from v1.2, to a FastAPI C2, then deletes itself.
• Prime ReverseShell: a PS2EXE-wrapped PowerShell reverse shell. One variant carries a comment telling LLMs the file is a harmless prime-number generator.
• IoCs (ESET): 89.44.9[.]186 (Prime ReverseShell C2, M247); 142.111.194[.]73 (BeautyStealer exfil, EGIHosting); SHA-1 0589D2079FBEF814DC7BB95C4B3B555C8B933AF6 (malicious RAR), E27E0D0A4B308F9B6B0469159931EB5E343E7FF8 (.xlsm lure). The full list is in ESET's GitHub repo.

Detection ideas: WinRAR writing .lnk files into a Startup folder; new LNKs in Startup that launch PowerShell against a script in %ProgramData%; non-browser processes reading browser Login Data/Cookies followed by traffic to api.telegram.org; and WinRAR versions below 7.13 still deployed.