Samantha Clarke and Mimecast Threat Research team have been monitoring and investigating a sophisticated phishing campaign targeting marketing organizations. The novel campaign sees threat actors impersonating a well-known brand, in attempts to lure victims into downloading malicious files from Dropbox. These malicious file ultimately seek to deliver malware in the form of Braodo Stealer.
Disseminated via phishing and spear-phishing emails, the malware utilises GitHub and a Singapore-based VPS server to host and distribute its code. Developed by threat actors based in Vietnam, Braodo Stealer exfiltrates internet browser data via Telegram bots. The stolen information includes credentials from financial platforms, as well as accounts from GitHub, Amazon AWS, and other platforms.
Analysis from Cyfirma details that the malware is obfuscated multiple times and uses batch scripts, PowerShell, executables (exe), HTA, and PDF files to spread. Multiple GitHub repositories are used to host the malicious code, while multiple Telegram bots are used for data exfiltration. It operates stealthily in the background, collecting and archiving data, which is then sent to Telegram bots. The full details of the malware’s capabilities can be read from Cyfirma’s threat research.
We have identified several attributes in the campaigns which have been added to our detection capabilities.
US and UK, Predominantly Media, Branding, Marketing, and Digital Advertising sectors.
Sender Domains:
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
