Hackers Use Fake VPN and Browser NSIS Installers to Deliver Winos 4.0 Malware

Cybersecurity researchers have revealed a malware campaign that employs fake software installers disguised as popular applications like LetsVPN and QQ Browser to deliver the Winos 4.0 framework. Initially detected by Rapid7 in February 2025, the campaign utilizes a multi-stage, memory-resident loader known as Catena. Catena incorporates embedded shellcode and configuration switching logic for staging, operating under specific guidelines to enhance its effectiveness and evade detection.

Full Article