[Stanley]

Researchers Expose Phishing Threats Distributing CountLoader and PureRAT

A new campaign has been observed impersonating Ukrainian government agencies in phishing attacks to deliver CountLoader, which is then used to drop Amatera Stealer and PureMiner.
"The phishing emails contain malicious Scalable Vector Graphics (SVG) files designed to trick recipients into opening harmful attachments," Fortinet FortiGuard Labs researcher Yurren Wan said in a report shared with The

https://thehackernews.com/2025/09/resear...rerat.html

[JoshAllen]

This campaign shows how phishing tactics are evolving. Fileless malware chains are proving that attackers are becoming more creative.

[B3A]

These email threats are getting more and more sneaky.
Its crazy how an SVG could end up on a miner/stealer..

always disable auto-open for ZIP/CHM

[DAL-SHA]

Phishing attacks getting more clever by using fake government emails and tricky files. People need to be more careful opening stuff online✌✌

[Fish]

This campaign shows how phishing tactics are evolving. Fileless malware chains are proving that attackers are becoming more creative.

This is very frightening. AI is probably helping people be even more creative

[Vectura]

That’s another reminder of how creative threat actors are getting with delivery methods. Using SVG files in phishing campaigns is clever because they often bypass traditional email filters—many systems don’t treat vector graphics as executable threats. Once CountLoader drops payloads like PureRAT or Amatera Stealer, attackers can exfiltrate credentials, system data, or even hijack computing resources for mining. Targeting Ukrainian agencies also suggests geopolitical motivations behind the operation, not just profit. It’s a good case study for why email security needs deeper content inspection beyond just file extensions or signatures.

[Aeowulf]

People are always the weakest link. Don't skimp out on your user training!

[Astaroth]

I would not call THN the most reliable news source. Something smells like a pig pen about the whole operation. Almost like the whole thing is setup to back up fake claims from the rotten and corrupt authorities in the US.

But hey, that's just me. You don't have to agree. (It rhymed funnily). 😄

[leste]

Phishing using SVG files? Attackers are getting creative.

[Oh_Well]

Seems like they're trying to milk infected systems long-term.

Props to Fortinet for catching it, but you know this playbook's gonna get reused fast!

[Yanix]

That’s a serious threat, especially with attackers impersonating government agencies. Using SVG files is a clever but dangerous trick. CountLoader and PureRAT sound like a nasty combo. People really need to be extra cautious with email attachments these days.

[Oh_Well]

That’s a serious threat, especially with attackers impersonating government agencies. Using SVG files is a clever but dangerous trick. CountLoader and PureRAT sound like a nasty combo. People really need to be extra cautious with email attachments these days.

Classic social engineering with a... very bad payload chain