Cybercriminals Are Using Fake VPN Installers for Spreading Malware

A recent investigation by the cybersecurity platform Rapid7 uncovered a sophisticated cyberattack campaign that uses fake installers to inject Winos 4.0 malware into the users’ devices.

According to Rapid7’s researchers “Catena uses embedded shellcode and configuration switching logic to stage payloads like Winos 4.0 entirely in memory, evading traditional antivirus tools”. In addition, “Once installed, it quietly connects to attacker-controlled servers – mostly hosted in Hong Kong – to receive follow-up instructions or additional malware.”

• The cyberattack campaign was discovered in February 2025.
• Bad actors use fake installers of services like VPNs, browsers, and optimization utilities to spread Winos 4.0 malware (advanced malicious framework that can extract data, provide remote shell access and execute DDoS attacks.
• The campaign uses a memory-resident loader called Catena to evade traditional security measures.
• When the malware is successfully injected, it stealthily connects to the attackers’ servers, primarily located in Hong Kong, to receive follow-up commands or spread additional malware.
• This cyberattack is connected to a threat cluster called Void Arachne (also known as Silver Fox).
• Active throughout 2025, demonstrating a reliable infection pattern with tactical adjustments that suggest a proficient and skilled threat actor.

Cybercriminals have become increasingly clever, using deceptive tactics that are harder to detect than ever before. To protect yourself, it’s crucial to adopt cybersecurity steps. One of the most important tips is to be cautious when installing new software, but this isn’t enough to ensure thorough protection. This is why we recommend that users get an internet security suite to efficiently prevent viruses and other cyberthreats from exploiting their devices.

Internet security suites are the best bet for protecting desktops, laptops, and smartphones and this applies to both businesses and individuals. This type of software typically offers:

• Real-time protection
• Firewall and network security
• Anti-phishing services
• Web protection
• Endpoint Detection and Response (EDR)
• Sandbox environment
• AI-driven detection systems
• Automatic updates
• VPN
• Password manager
• Timely notifications