Shark Stealer & EtherHiding & Captchas: End of year evasion pack

VMware researchers Arurul and Julian Wolf review 2025's top threat detection trends, highlighting new WTI detections, Yara rules, and a spotlight on the Ether Hiding technique used by Shark Stealer 1:09.

Key Takeaways:
• The team added dozens of new Windows Threat Intelligence detections, config extractors, and hundreds of Yara rules driven by a rapidly shifting threat landscape 1:45.
• New VTIs target direct system calls for EDR evasion, dropped files masquerading as system utilities like MSI exec, and brand-logo overlays on captchas for phishing 1:50.
• Yara rule updates address Cloudflare captchas, fake captchas serving as leading initial access techniques, and malicious VS Code extensions posing supply chain risks 1:50.
• Shark Stealer leverages Ether Hiding to store encrypted C2 data on the BNB blockchain, accessed via a stable Binance testnet API endpoint that offers high-fidelity, low false-positive detection opportunities 1:09.

The session reflects VMware's shift toward sharing campaign-level intelligence alongside detection updates, with the next webinar planned for late January 2026.

Sources:

• 1:09 Introduction and Ether Hiding spotlight.
• 1:45 WTI additions and Yara rule overview.
• 1:50 Details on new VTIs and config extractors.