Russian Crew Hides Starland Backdoor Inside Fake Zoom and WebEx Installers

Key points

• Cisco Talos says a Russian criminal group it tracks as UAT-11795 has been running the campaign since at least June 2025.
• The hackers hide a new backdoor called Starland inside tampered installers for MobaXterm, WebEx, Zoom, DBeaver and FaceIT.
• Most victims are in the United States, with further infections in Germany, Romania and Venezuela.
• Starland hunts for browser logins and more than 40 desktop and browser-extension cryptocurrency wallets.
• Follow-on malware includes CastleStealer, which grabs Discord and Steam sessions, and Remcos, a remote access tool with keylogging, webcam capture and audio recording.

A Russian criminal group is quietly poisoning downloads of software that millions of office workers use every day.

Researchers at Cisco Talos published their findings this week. They track the group as UAT-11795. The goal is stolen logins and stolen cryptocurrency.

The crew wraps everyday tools like Zoom, WebEx, MobaXterm and the FaceIT gaming client in tampered installers. Run one, and you get the real app plus a hidden backdoor called Starland, a remote access trojan first spotted in these attacks.

How are people getting tricked into installing it?

Talos believes the group is using ClickFix, a technique where a fake error message on a website tells you to paste a command into your computer to fix something. Paste it, and you've just installed the malware yourself.

The infection unfolds in stages. An HTA file retrieves a booby-trapped installer containing a Python loader dressed up as a plain LICENSE.txt. That loader edits the Windows Registry so the malware runs at every startup, then decrypts and deploys Starland.

Once active, Starland checks whether it is running inside a security researcher's test environment. If the coast looks clear, it adds scheduled tasks for persistence, tries to grant itself more power on the machine, and starts hunting.

What is it stealing?

Quite a lot. Starland scrapes saved passwords and cookies from browsers. It targets more than 40 desktop and browser-extension cryptocurrency wallets. System details collected include the machine's hardware ID, processor, RAM, public internet address and which antivirus is installed. On business networks it also maps out Active Directory, the system companies use to manage staff logins, so the attackers can see who holds admin rights.

Starland can then pull down more malware. Talos saw two follow-ups in real attacks: CastleStealer and Remcos.

CastleStealer is an information stealer that targets browser credentials, cryptocurrency wallet data and Discord, Telegram and Steam sessions. We first reported on CastleStealer on 22 June 2026, when Elastic Security Labs linked it to a likely Russian-speaking operator pushing it through poisoned Google ads. Remcos is a well-known remote access tool that logs keystrokes, records the webcam, captures audio and monitors the clipboard.

Should ordinary users be worried?

Only if you install software from places you shouldn't. The safest habit is boring but effective: type the vendor's real address into the browser yourself and download from there. Never paste a command copied from a pop-up into PowerShell or the Run box.

Would multi-factor authentication stop this? Starland lifts session cookies straight from the browser, letting attackers walk past both a password and a one-time code. The real defence is not installing the thing in the first place, paired with a password manager that refuses to autofill on the wrong site.

One technical detail worth flagging: if Starland cannot reach its usual control server, it queries a smart contract on the Polygon blockchain to fetch an XOR-encrypted fallback address. That makes the network infrastructure harder to disrupt than a simple domain block. Talos also found a previously undocumented PowerShell framework the crew uses internally, called WLDR, which operates entirely in memory and ties each payload to one specific victim's hardware ID.

The session-cookie theft here is the thing to watch. MFA fatigue gets a lot of attention, but cookie hijacking sidesteps OIDC token validation and refresh-token rotation alike. No prompts, no alerts.

Indicators of compromise are in the Cisco Talos writeup for defenders who want to hunt for this. First reported by BleepingComputer.