Do Son ASEC exposed a SteamCleaner malware clone signed with a valid certificate. It installs a Node.js RCE backdoor via InnoSetup, evades sandboxes, and is suspected of running Proxyware for profit.
anti-sandbox
Trellix analysis reveals Lumma Stealer's latest tactics: code obfuscation, API hashing, ETW evasion, anti-VM. Learn how this InfoStealer avoids detection.