Gh0st RAT, CloverPlus Hit Victims in Dual

Gbhackers •Mayura Kathir • April 20, 2026

A new malware campaign is bundling a powerful remote access trojan (RAT) with intrusive adware, giving attackers both long-term control of infected systems and an immediate revenue stream from fraudulent advertising activity. The loader hides two encrypted payloads in its resource section, one of which is detected as AdWare.Win32.CloverPlus. Once executed, this adware installs advertising […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gh0st RAT and CloverPlus Adware Distributed in New Malware Campaign A new malware campaign has been identified that combines the Gh0st Remote Access Trojan (RAT) with CloverPlus adware. This dual threat allows attackers to maintain long-term control over infected systems while generating immediate revenue through fraudulent advertising. The malware is delivered via a single obfuscated loader that conceals two encrypted payloads, one of which is identified as AdWare.Win32.CloverPlus. Victims of this campaign are primarily individual users and organizations that may be targeted for financial gain. The attack method involves executing the loader, which installs both the RAT and the adware on the victim's machine. This campaign raises significant concerns due to the potential for widespread impact and the dual nature of the threats involved. Current status indicates that the cybersecurity community is actively monitoring the situation as reports of infections emerge. 3 sources 62

Gh0st RAT, CloverPlus Hit Victims in Dual

The full story

Extracted Entities

Attack Types (2)

Malware (3)