Threat actors are advertising GhostNet, a cross-platform malware targeting Windows, macOS, and Linux with features like HVNC, browser stealing, and reverse proxies. Learn how GhostNet operates, its step-by-step attack chain, and the precise detection and containment strategies needed to secure your enterprise.
Administrative compromise across Windows, Linux, and macOS environments is the immediate business threat facing enterprises as threat actors begin commercializing highly versatile cyberattack toolkits on underground forums. A prominent seller on the Exploit.in platform has announced the sale of GhostNet, a newly developed cross-platform remote access trojan and information stealer. Capable of operating natively across major operating systems, GhostNet represents a growing trend where underground toolkits are unified under a single command and control framework to bypass historical operating system barriers. The implications for enterprise targets are severe, as the tool boasts advanced administrative interception features such as Hidden Virtual Network Computing, credential theft, adversary-in-the-middle proxy capabilities, and clipboard hijacking.
Cross-platform RAT and info-stealer targeting Windows, macOS, and Linux.
For GCC enterprises operating complex hybrid infrastructures, the introduction of an accessible, multi-platform administrative toolkit lowers the barrier of entry for cybercriminals. Standard corporate networks often rely on the assumption that macOS and Linux systems require entirely different security postures or are inherently safer than Windows workstations. Toolkits like GhostNet shatter this assumption by standardizing attack flows, allowing a single malware package to target active developers on Linux, corporate executives on macOS, and administrative staff on Windows. To combat this multi-faceted exposure, organizations must actively audit their external boundaries and identify where credentials might already be compromised. Leveraging a comprehensive Dark Web Monitoring strategy is critical to identifying compromised corporate domains before attackers exploit these access points.
The technical architecture of the GhostNet framework relies on modular architecture designed to exploit standard system protocols and bypass traditional network defenses. Unlike older, mono-platform trojans, GhostNet operates using natively compiled binaries tailored for each specific operating system (Portable Executable files for Windows, Executable and Linkable Format files for Linux, and Mach-O binaries for macOS). This enables the adversary to deploy a single operational playbook across an entire corporate fleet once initial access is achieved.
One of the most dangerous capabilities advertised within the GhostNet framework is Hidden Virtual Network Computing. Traditional VNC tools mirror the active user screen, making unauthorized access immediately visible to the operator. GhostNet bypassed this limitation by spawning an invisible virtual desktop session on the targeted host. On Windows systems, this is achieved by leveraging native API calls to create alternative desktop structures and invisible windows, mapping input from the attacker directly to this secondary, unmapped display buffer. This allows the threat actor to open web browsers, navigate file managers, execute local commands, and exfiltrate databases invisibly, even while the legitimate user is actively working on the primary monitor.
The malware incorporates sophisticated network manipulation modules, specifically a local proxy client and a SOCKS5 reverse proxy. The local proxy functions as a secure TLS interceptor. By forcing the host operating system to trust a generated malicious Root CA certificate, the malware intercepts and inspects outgoing HTTPS traffic. When users attempt to connect to enterprise SaaS applications, financial portals, or webmail platforms, the malware intercepts the requests, decrypting and hijacking session tokens in real time. Additionally, the reverse SOCKS5 proxy capability transforms the victim machine into an egress hub, allowing the remote attacker to route traffic through the target organization's trusted IP space. This allows the attacker to bypass geography-based access controls and launch secondary attacks from within the corporate security perimeter.
GhostNet functions as an advanced information stealer that targets the local SQLite databases of major web browsers, including Chrome, Firefox, Safari, and Edge. Upon execution, the malware searches standard user application directories to locate session directories, autofill forms, saved login configurations, and browser cookies. By extracting active session cookies, the malware enables attackers to perform session hijacking attacks, effectively bypassing Multi-Factor Authentication (MFA) protocols on web-based enterprise services. This harvested data is structured and exfiltrated to the command and control server via encrypted channels.
The clipboard hijacking module operates as a persistent listener thread on the endpoint, constantly hooking system API calls that manage clipboard contents. The primary objective is to identify specific regular expression matches, particularly those representing cryptocurrency wallet addresses or financial routing codes. When a matching string is detected, the malware dynamically replaces the user's copied address with the threat actor's pre-configured wallet address in the system clipboard. This technique targets transaction flows, diverting financial assets before the user realizes the clipboard data has been manipulated.
Spearphishing or web vectors
System-specific native binary
Registry, LaunchAgents, or systemd
Modular plugin architecture
HVNC, MitM, & session hijacking
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
The alleged sale of the Stealc_v2 information-stealing malware source code on the exploit.in forum introduces major corporate security challenges. Featuring a PHP administration panel, customizable builders, and Telegram bot integrations, this leak enables rapid deployment of stealthy credential-harvesting campaigns.
June 25, 2026
A threat actor is selling the source code of the Predator 1.6 remote access trojan and file binder on the cybercrime forum Spear. This development lowers the technical barrier for deploying persistent backdoors, posing immediate security risks that demand behavioral EDR rules and path restrictions.
July 3, 2026
A threat actor known as the Infrastructure Destruction Squad has commercialized and leaked the source code for TRK25 ADVANCED SCADA, a PyQt5-based tool that targets industrial control systems, remote management ports, and Modbus-enabled machinery.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
For organizations looking to validate their wider security posture against advanced cross-platform threats, partnering with offensive experts is highly recommended. Implementing regular Penetration Testing allows enterprises to simulate multi-stage attacks, identify lateral movement vulnerabilities, and confirm that monitoring controls are operating as designed.
To establish a resilient defense, security teams must understand the exact progression of a GhostNet intrusion. The attack chain represents a standard execution path from initial entry to operational impact.
Initial Access: Attackers distribute the GhostNet payload through target-specific vectors. These commonly include spearphishing campaigns with malicious attachments, trojanized system tools, search engine optimization poisoning that redirects users to fake installer pages, or leveraging vulnerabilities in internet-facing systems. Organizations can identify exposed entry points by employing continuous Attack Surface Management to discover and patch external vectors.
Payload Execution: The target executes the system-specific binary. Upon startup, the binary performs sandbox evasion routines, checking for virtual machine environments, specific debugger configurations, or common security agent processes before making outbound connections.
Persistence Establishment: To ensure continuous access, the malware modifies system configuration files. On Windows, it adds registry values to the run keys or schedules tasks. On macOS, it copies system configuration plists to LaunchAgents or LaunchDaemons. On Linux systems, it creates systemd services or modifies cron schedules.
Command and Control (C2) Signaling: GhostNet establishes a secure link to the attacker's C2 server. This connection allows the operator to execute modular plugins, initiate proxy routing, or launch interactive console commands.
Data Exfiltration and Impact: The attacker harvests host information, exfiltrates stolen session cookies and credentials, and runs background proxy utilities to prepare for lateral movement or subsequent ransomware deployment.
Relying on generic antivirus signatures is insufficient for commodity cross-platform threats that undergo rapid iteration and compiler-level obfuscation. Security operations centers must deploy specific detection rules and behavioral heuristics to find and neutralize GhostNet infections.
Organizations should configure their security monitoring tools to alert on the following anomalous behavioral patterns:
Trust Store Modification: Monitor for unauthorized additions of root certificates to the system's trusted root authority store. On Windows, alert on modifications to the registry path HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT. On macOS and Linux, flag system changes to /etc/ssl/certs/ or changes made to the system keychain using command-line commands.
Local Proxy Redirects: Flag unauthorized changes to browser and system network settings, specifically configurations that enforce local loopback redirects (pointing to 127.0.0.1) or the installation of automatic proxy configuration (PAC) scripts. Monitor the Windows registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL for unexpected updates.
Abnormal Browser Spawning: Generate alerts when web browser processes (such as chrome.exe or firefox.exe) are spawned by unusual parent processes or with parameters indicating temporary or custom user-data directories, a common indicator of HVNC activity.
If an endpoint is suspected of harboring a GhostNet infection, incident response teams should execute the following verification steps:
Verify system trust anchors by running command-line tools to list all installed CA certificates, looking for randomized names, self-signed issuers, or certificates not deployed via enterprise policy.
Inspect active network listeners using command-line tools such as netstat -ano on Windows or ss -tulpn on Linux to check for anomalous active listeners on localhost ports.
Audit startup configurations using PowerShell commands such as Get-CimInstance Win32_StartupCommand or macOS commands like launchctl list to isolate undocumented binary configurations.
Once an infection is confirmed, rapid containment is necessary to prevent further exposure:
Isolate the compromised system immediately from both the local network and the internet to terminate active SOCKS tunnels and sever the C2 channel.
Remove any unauthorized certificates that were added to the local trust store during the intrusion.
Revoke all active enterprise SaaS, cloud platform, and email sessions associated with any user accounts linked to the infected endpoint, as session cookies were likely exfiltrated.
Enforce a mandatory password reset for all user credentials stored in local browser databases or utilized on the affected machine.
