Armored Likho Turns Windows Microphones Into Automated Eavesdropping Devices

Gbhackers •Mayura Kathir • August 13, 2026

Armored Likho, also tracked as Eagle Werewolf, has expanded its espionage capability with a Rust-based toolkit that can hijack Telegram sessions and transform compromised Windows endpoints into automated audio-surveillance devices. The newly documented May 2026 campaign primarily targets Russian private individuals, corporations, government bodies, IT organizations, and educational institutions through a fraudulent donation-service application. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Armored Likho Expands Cyber-Espionage with New Rust Toolkit In May 2026, the Armored Likho group, also known as Eagle Werewolf, launched a cyber-espionage campaign targeting private individuals and organizations in Russia, including corporations, government bodies, and educational institutions. The attackers employed a fraudulent donation-service application as the initial infection vector. The campaign features a new Rust-based toolkit called the Still Toolkit, which includes components for hijacking Telegram sessions and conducting audio surveillance via compromised Windows devices. The Still Sync component steals Telegram session data, while Still Audio records conversations and transmits them to a command-and-control server. The malicious app masquerades as a legitimate donation service, deceiving users into providing access. Kaspersky products detect the threat as Trojan.Win64.Agent.* and HEUR:Backdoor.Win32.Generic. This campaign shows significant overlap with previous Armored Likho activities documented in November 2024, February 2026, and July 2026. The distribution method for the fake app remains unknown as of this writing. 2 sources 71

Extracted Entities

Armored Likho Turns Windows Microphones Into Automated Eavesdropping Devices

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (1)

Industries (1)

Platforms (1)