APT28, the Russia-linked advanced persistent threat group, has launched a sophisticated campaign targeting Central and Eastern Europe using a zero-day vulnerability in Microsoft Office.

The threat actors leveraged specially crafted Microsoft Rich Text Format (RTF) files to exploit the vulnerability and deliver malicious backdoors through a multi-stage infection chain.

The campaign, tracked as Operation Neusploit, represents a significant escalation in APT28’s capabilities and demonstrates their continued focus on high-value targets across Ukraine, Slovakia, and Romania.

The attack begins when users receive socially engineered emails containing weaponized RTF documents.

These messages are customized in English and local languages including Romanian, Slovak, and Ukrainian to increase the likelihood of successful infection.

Once victims open these files, the vulnerability is silently triggered, allowing the threat actors to execute arbitrary code on the compromised system without any visible warning to the user.

Zscaler analysts identified this campaign in January 2026 and attributed it to APT28 based on significant overlaps in tools, techniques, and procedures with the group’s known operations.

The researchers observed active exploitation occurring in the wild on January 29, 2026, just three days after Microsoft released an emergency security update to address the vulnerability.

Infection Mechanism and Persistence Strategy

The infection chain involves two distinct variants of dropper malware designed to deploy different payloads to compromised systems.

The first variant deploys MiniDoor, a lightweight email-stealing tool built using Microsoft Outlook Visual Basic for Applications (VBA).

MiniDoor operates by monitoring Outlook login events and systematically harvesting emails from the infected mailbox. The malware forwards stolen communications to hardcoded email addresses controlled by the attackers.

To maintain persistence, the dropper modifies Windows registry settings to disable Outlook security protections and automatically load the malicious macro each time the application launches.

• CVE ID: CVE-2026-21509
• Vulnerability Type: Remote Code Execution
• Affected Component: Microsoft Office RTF Handler
• Severity: Critical
• Patch Date: January 26, 2026

The second dropper variant deploys PixyNetLoader, which establishes a foothold for deploying the Covenant Grunt implant, providing the attackers with command-and-control capabilities.

Both variants employ server-side evasion techniques, delivering payloads only to requests originating from targeted geographic regions with correct HTTP headers. This selective delivery makes detection and analysis significantly more challenging for security researchers worldwide.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post APT28 Hackers Exploiting Microsoft Office 0-Day in the Wild to Deploy Malware appeared first on Cyber Security News.

A dangerous banking malware called Anatsa has been discovered spreading through the Google Play Store, reaching more than fifty thousand downloads before detection.

The malicious application was cleverly hidden as a document reader, making it appear harmless to unsuspecting users searching for legitimate file management tools.

This discovery highlights how cybercriminals continue to exploit official app stores as distribution channels for sophisticated financial threats targeting Android users worldwide.

The Anatsa banking trojan is particularly concerning because it specifically targets banking credentials and sensitive financial information from infected devices.

The malware operates as an installer that downloads and deploys the full Anatsa banking trojan payload once the initial application gains access to a device.

Users who downloaded and installed this fake document reader application unknowingly gave the malware permission to operate with elevated access, creating a gateway for financial theft and personal data extraction.

The distribution method through Google’s official marketplace made this attack particularly effective, as users typically trust applications found on authorized platforms.

This represents a significant breach in app store security screening processes, demonstrating how malicious developers continue to evade detection systems.

Zscaler ThreatLabz analysts identified this malicious application and immediately began tracking its distribution network and associated command-and-control infrastructure.

The security researchers confirmed the malware’s connection to banking theft operations and provided detailed technical indicators to help other security teams detect infected devices.

Their investigation revealed the attack chain and documented how the malware communicates with external servers to receive commands and exfiltrate stolen banking information.

Analyzing the Malware’s Infection and Communication Mechanism

Understanding how Anatsa establishes persistence on infected Android devices is crucial for users and security professionals seeking to prevent compromise.

Once installed, the banking trojan integrates itself into the operating system and actively monitors user activity, particularly focusing on banking application interactions.

When users open their banking applications or enter financial credentials, the malware captures this sensitive information through overlay attacks and credential logging techniques.

The malware then communicates with command-and-control servers located at specific IP addresses, transmitting stolen banking details directly to threat actors.

This direct connection to attacker-controlled infrastructure means compromised devices remain under active threat actor control, continuously feeding banking information and session tokens to criminal operations.

Security researchers recommend users immediately remove any suspicious document reader applications, verify app authenticity through official channels, and enable multi-factor authentication on all banking accounts to mitigate potential compromise risks.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Malicious App on The Google Play with 50K+ Downloads Deploy Anatsa Banking Malware appeared first on Cyber Security News.