Gh0st RAT and CloverPlus Adware Delivered Together in New Dual

Cybersecuritynews •Tushar Subhra Dutta • April 20, 2026

A newly identified malware campaign is raising serious concerns across the cybersecurity community by delivering two very different threats at the same time. Attackers are now using a single, obfuscated loader to push both Gh0st Remote Access Trojan (RAT) and CloverPlus adware onto the same victim machine, giving them both long-term system control and an […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gh0st RAT and CloverPlus Adware Distributed in New Malware Campaign A new malware campaign has been identified that combines the Gh0st Remote Access Trojan (RAT) with CloverPlus adware. This dual threat allows attackers to maintain long-term control over infected systems while generating immediate revenue through fraudulent advertising. The malware is delivered via a single obfuscated loader that conceals two encrypted payloads, one of which is identified as AdWare.Win32.CloverPlus. Victims of this campaign are primarily individual users and organizations that may be targeted for financial gain. The attack method involves executing the loader, which installs both the RAT and the adware on the victim's machine. This campaign raises significant concerns due to the potential for widespread impact and the dual nature of the threats involved. Current status indicates that the cybersecurity community is actively monitoring the situation as reports of infections emerge. 3 sources 62

Gh0st RAT and CloverPlus Adware Delivered Together in New Dual

The full story

Extracted Entities

Attack Types (1)

Malware (2)