News Highlights
- Attackers using highly convincing, animated lures to trick users into trusting malicious sites and downloads.
- Threat actors carrying out convincing campaigns with minimal effort by using purchasable tools – like PureRAT, and Phantom Stealer – reusing templates and abusing trusted platforms.
- Attackers evading detection through DLL sideloading, modified legitimate tools and continuous adaptation to new Windows protections.
PALO ALTO, Calif., 11 December 2025 — HP Inc. (NYSE: HPQ) today issued its latest Threat Insights Report, revealing how attackers are refining campaigns with professional-looking animations and purchasable malware services. HP Threat Researchers warn that these campaigns mix convincing visuals, well known hosting platforms like Discord, and regularly updated malware kits to evade detection by users and detection tools.
The report provides an analysis of real-world cyberattacks, helping organizations keep up with the latest techniques cybercriminals use to evade detection and breach PCs in the fast-changing cybercrime landscape. Based on the millions of endpoints running HP Wolf Security*, notable campaigns identified by the HP Threat Research Team include:
- DLL sideloading slips past endpoint security scanners: Attackers impersonating the Colombian Prosecutor’s Office emailed fake legal warnings to targets. The lure directs users to a fake government website, which displays a slick auto-scroll animation guiding targets to a “one-time password”, tricking them into opening the malicious password-protected archive file.
- The file – once opened – launches a folder that includes a hidden, maliciously modified dynamic link library (DLL). This installs PureRAT malware in the background, giving attackers full control of a victim’s device. The samples were highly evasive. On average, only 4 per cent of related samples were detected by anti-virus tools.
- Fake Adobe update installs remote access tool: A fake Adobe-branded PDF redirects users to a fraudulent site that pretends to update their PDF reader software. A staged animation shows a spoofed installation bar that mimics Adobe. This tricks users into downloading a modified ScreenConnect executable – a legitimate remote access tool – which connects back to attacker-controlled servers, so they can hijack the compromised device.
- Discord malware dodges Windows 11 defences: Threat actors hosted their payload on Discord to avoid building their own infrastructure and piggybacked off the positive domain reputation of Discord. Before deployment, the malware patches Windows 11’s Memory Integrity protection to bypass this security feature. The infection chain then delivers Phantom Stealer, a subscription-based infostealer sold on the hacking marketplaces with ready-made credential and financial theft features that update frequently to evade modern security tools.
Patrick Schläpfer, Principal Threat Researcher, HP Security Lab, comments: “Attackers are using polished animations like fake loading bars and password prompts to make malicious sites feel credible and urgent. At the same time, they are relying on off-the-shelf, subscription malware that is fully featured, and updates as fast as legitimate software. This is helping threat actors keep ahead of detection-based security solutions and slip past defences with far less effort.”
Alongside the report, the HP Threat Research Team has published a blog analyzing the threat of session cookie hijacking attacks, the use of stolen credentials in intrusions and the proliferation of infostealer malware. Rather than stealing passwords or bypassing multi-factor authentication (MFA), attackers are hijacking the cookies that prove a user is already logged in, giving them instant access to sensitive systems. HP analysis of publicly reported attack data found that over half (57%) of the top malware families in Q3 2025 were information stealers, a type of malware that typically has cookie theft capabilities.
By isolating threats that have evaded detection tools on PCs – but still allowing malware to detonate safely inside secure containers – HP Wolf Security has insight into the latest techniques used by cybercriminals. To date, HP Wolf Security customers have clicked on over 55 billion email attachments, web pages, and downloaded files with no reported breaches.
The report, which examines data from July – September 2025, details how cybercriminals continue to diversify attack methods to bypass security tools that rely on detection, such as:
- At least 11% of email threats identified by HP Sure Click bypassed one or more email gateway scanners.
- Archive files were the most popular delivery type (45%), seeing a 5% point rise over Q2, with attackers increasingly using malicious .tar and .z archive files to target users.
- In Q3, 11% of threats stopped by HP Wolf Security were PDF files, growing 3% points over the previous quarter.
Dr. Ian Pratt, Global Head of Security for Personal Systems at HP Inc., comments: “With attackers abusing legitimate platforms, mimicking trusted brands and adopting convincing visual tricks, like animations, even strong detection tools will miss some threats. Security teams can’t predict every attack. But by isolating high-risk interactions, such as opening untrusted files and websites, organisations gain a safety net that contains threats before they can cause harm, without adding friction for users.”
Please visit the Threat Research blog to view the report.
About the Data
This data was gathered from consenting HP Wolf Security customers from July – September 2025 with investigations conducted by the HP Threat Research Team.
About HP Wolf Security*
HP Wolf Security is world class endpoint security. HP’s portfolio of hardware-enforced security and endpoint-focused security services are designed to help organizations safeguard PCs, printers, and people from circling cyber predators. HP Wolf Security provides comprehensive endpoint protection and resiliency that starts at the hardware level and extends across software and services. Visit https://hp.com/wolf.