CNCMachineRMS: The Undocumented RAT At the End of a BabaDeda Chain

Reported 11 Aug 2026 by otx · Severity: medium

An investigation uncovered a sophisticated infection chain beginning with a ClickFix lure and utilizing a legitimately signed IBM SPSS IDE alongside four decoy DLLs and a date-formatting API as a trampoline. This chain deploys BabaDeda loader stage that ultimately delivers CNCMac