Cybersecurity researchers have disclosed a malware marketing campaign that makes use of pretend software program installers masquerading as well-liked instruments like LetsVPN and QQ Browser to ship the Winos 4.0 framework.
The marketing campaign, first detected by Rapid7 in February 2025, includes using a multi-stage, memory-resident loader known as Catena.
“Catena makes use of embedded shellcode and configuration switching logic to stage
Hackers Use Faux VPN and Browser NSIS Installers to Ship Winos 4.0 Malware
