// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //

FILE PUB-ENTDTG 0600Z

ColdRecon › Techniques › T1036

Technique T1036

Masquerading

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Masquerading (T1036) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1036

TacticDefense Evasion

Incidents on file25

Detection & mitigation

Monitor for execution of suspicious files downloaded from GitHub, especially those with low reputation or newly created repositories. Use endpoint detection to identify SmartLoader behavior such as process injection or suspicious network connections. Educate users to verify repository authenticity before downloading.

Observed in the wild

2026-10-09

masquerading
FakeGit campaign reactivates, distributing SmartLoader malware via GitHub

2026-10-08

masquerading
Counterfeit installers lead to persistent implant

2026-10-06

masquerading
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

2026-10-05

masquerading
Microsoft warns of fake CAPTCHA tests hijacking Windows PCs

2026-10-01

masquerading
GlassWorm Targets macOS via Malicious VS Code Extensions

2026-10-01

masquerading
Microsoft Warns of MSP360 RMM Abuse in Phishing Attacks

2026-09-30

masquerading
Russian state hackers use new RedFlick technique to push malware

2026-09-29

masquerading
Hackers Weaponize ChatGPT Custom GPT Feature to Distribute Malware

2026-09-23

masquerading
Graphalgo Malware Campaign Targets Cloud Credentials via Malicious Terraform Providers and Go Modules

2026-09-23

masquerading
DarkMe campaign uses fake image file instead of zero-day exploits

2026-09-22

masquerading
Exvicy malware-as-a-service framework copies rival's code

2026-09-21

masquerading
WaterPlum hackers use fake coding tests to infect 30,000 devices and steal $10 million in crypto

2026-09-18

masquerading
Fake GitHub Repositories Distributing Rapuncel Infostealer via Google Search

2026-09-18

masquerading
WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

2026-09-17

masquerading
HP Wolf Security research reveals cybercriminals evading EDR using VHD mounting and other techniques

2026-09-16

masquerading
CrowdStrike links PhantomRaven malware to bug bounty hunter

2026-09-15

masquerading
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

2026-09-15

masquerading
Quick Heal Flags Evolving WhatsApp Malware Campaign

2026-09-12

masquerading
Phishing Campaign Abuses Mshta.exe to Execute HTA and Steal Credentials

2026-09-11

masquerading
Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

2026-09-09

masquerading
Multi-stage credential-stealing malware abuses Google CAPTCHA, WebDAV, and BNB Smart Chain

2026-09-07

masquerading
Fake Minecraft Mod Drops Myth Stealer RAT

2026-09-07

masquerading
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

2026-09-01

masquerading
Threat Actors Abuse ChatGPT Shared Links to Distribute NetSupport RAT

2026-08-26

masquerading
WordlistLoader and SynkLoader Target Windows Credentials

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →