Rhadamanthys in a fake update lure

Summary

From the start of October, Huntress recorded a second lure feeding the same steganographic loader. Here the browser was pushed into full screen and dressed up as the blue update splash, animations included, before the viewer was asked to open the Run box and paste a line already sitting on the clipboard. The page source was not obfuscated, carried Russian comments, and posted each interaction to a statistics script, which gave Huntress a urlscan pivot for finding more sites. Five partner incidents between 1 and 17 October used one address for both the mshta stage and the PowerShell behind it, with only the filename rotating; the operator later moved the second-stage domain but kept the address. The payload at the end was Rhadamanthys, not Lumma. A takedown of Rhadamanthys infrastructure was announced on 13 November, yet more sites still served the lure on 19 November.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

1 of 21

Checks recorded

2

Checks since publication

2

Never checked

20

Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 20 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 5 of these mechanisms appear together in 2 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

21 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.