InfoSecBulletin Cybersecurity for mankind
ElizaRAT is malware that mainly targets Windows systems and acts as a remote access tool (RAT), allowing attackers to access infected devices without permission. This malware is often distributed through phishing campaigns or malicious downloads.
CheckPoint researchers found that APT36 (aka “Transparent Tribe”) is a Pakistan-based APT group, hackers are targeting high-profile Windows users with ElizaRAT.
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
ElizaRAT was initially identified in 2023, and since then, it has evolved significantly by incorporating advanced features.The infection chain of ElizaRAT begins with “phishing emails” containing malicious “CPL” files distributed via “Google Storage links.”
It establishes persistence by creating a “unique victim ID,” “setting up working directories in %appdata%,” and deploying secondary payloads like “ApoloStealer.”
The Checkpoint report states that this stealer component targets sensitive file types (“.doc,” “.pdf,” “.ppt,” “.xls”) and performs “systematic data exfiltration” via encrypted channels.
The malware employs sophisticated evasion techniques like:-
Time zone verification checks for India Standard Time.
Maintains reliability via various C2 communication methods.
Ranging from Slack API calls to Google Cloud Storage service account authentication using X.509 certificates.
Each campaign variant illustrates increasingly sophisticated capabilities while maintaining the core objective of persistent data theft from targeted “Indian institutions.” ‘ConnectX’ is a USB-targeting malware component within the ElizaRAT ecosystem.
click here to read full report.
