Not Just Annoying Ads: Adware Bundles Delivering Gh0st RAT

Reported 17 Apr 2026 by otx · Severity: medium

A sophisticated malware campaign is distributing both Gh0st Remote Access Trojan and CloverPlus adware simultaneously through obfuscated loaders. The loader drops encrypted payloads from its resource section, with one being adware and another a Gh0st RAT DLL module executed via r