RUSSIAN GROUP ENCRYPTHUB EXPLOITS MSC EVILTWIN VULNERABILITY TO DEPLOY FICKLE STEALER MALWARE

Summary from the TLDR InfoSec newsletter

Russian threat actor EncryptHub is exploiting patched Windows vulnerability CVE-2025-26633 via social engineering and malicious MSC files to deploy Fickle Stealer malware and backdoors. The group uses fake IT support requests, a compromised Brave Support platform, and fake videoconferencing to gain control. Attacks feature encrypted C2, persistence, and evasion techniques like fake browser traffic.