The toolkit let intruders hold ground inside telecom, university and government networks.
A signed banking token becomes the delivery vehicle for an implant that talks to its handlers over IoT messaging.
Kaspersky ties the backdoor's new disguise to Silver Fox, which hid it inside a signed Chinese wallpaper tool.
Microsoft tracks a ClickFix variant that drops a Python reverse tunnel through fake CAPTCHA overlays.