Fake Security Tool Spreads LucidRook in Taiwan Cyberattacks

Gbhackers •Mayura Kathir • April 9, 2026

Hackers are using fake security tools and cleverly crafted phishing emails to secretly deploy a new malware family, LucidRook, against organizations in Taiwan. The campaign, tracked as UAT-10362, focuses on Taiwanese NGOs and likely universities and shows a high level of planning, stealth, and technical sophistication. The operation relies on spear-phishing emails sent via what appears […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LucidRook Malware Targets NGOs and Universities in Taiwan A new Lua-based malware named LucidRook is being deployed in targeted attacks against non-governmental organizations and universities in Taiwan. The threat group UAT-10362 is believed to be behind these spear-phishing campaigns, which began in October 2025. Attackers utilize phishing emails containing password-protected archives and fake security tools to deliver the malware. LucidRook features a modular design with a built-in Lua execution environment, allowing for stealthy updates and execution of second-stage payloads. The malware collects system information and exfiltrates data using FTP and Gmail GMTP. Cisco Talos researchers have identified two infection chains involving a malware dropper called LucidPawn and a fake antivirus executable. The attacks are characterized by high levels of planning and technical sophistication, complicating reverse-engineering efforts. Current assessments indicate that the attacks are part of a targeted intrusion campaign. 7 sources 61

Extracted Entities

Fake Security Tool Spreads LucidRook in Taiwan Cyberattacks

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)