Back Scworld

Novel malware campaign bundles Gh0st RAT, CloverPlus adware | brief

Scworld • April 21, 2026

GBHackers News reports that intrusions deploying the Gh0st RAT payload alongside the CloverPlus adware have been launched as part of a new malware campaign aimed at simultaneously generating immediate revenues and prolonging control of infected systems.

Threat actors have leveraged an obfuscated loader to facilitate the execution of CloverPlus, which injects advertising components and prompts pop-ups for click and traffic monetization, while preparing to deliver a Gh0st RAT client DLL for total remote access to the targeted system, findings from the Splunk Threat Research Team revealed.

Activation of Gh0st RAT upon ensuring that it was not executed from a %temp% environment allows access token manipulation, user and network discovery, system profiling, and persistence, while avoiding detection by checking execution in a virtual machine, leveraging a ping-based sleep technique, and exploiting DNS. Gh0st RAT was also reported to enable keystroke logging and Remote Desktop activity targeting for the subsequent sensitive credential and other remote administration data siphoning and lateral movement.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gh0st RAT and CloverPlus Adware Distributed in New Malware Campaign A new malware campaign has been identified that combines the Gh0st Remote Access Trojan (RAT) with CloverPlus adware. This dual threat allows attackers to maintain long-term control over infected systems while generating immediate revenue through fraudulent advertising. The malware is delivered via a single obfuscated loader that conceals two encrypted payloads, one of which is identified as AdWare.Win32.CloverPlus. Victims of this campaign are primarily individual users and organizations that may be targeted for financial gain. The attack method involves executing the loader, which installs both the RAT and the adware on the victim's machine. This campaign raises significant concerns due to the potential for widespread impact and the dual nature of the threats involved. Current status indicates that the cybersecurity community is actively monitoring the situation as reports of infections emerge. 3 sources 62

Extracted Entities

Novel malware campaign bundles Gh0st RAT, CloverPlus adware | brief

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (9)