Rhadamanthys and compromised NHIs reshape malware delivery risk

At a glance

What this is: Proofpoint says Rhadamanthys now reaches victims through compromised websites, malvertising, email, and ClickFix social engineering, turning delivery channels and identity trust into a single malware risk.

Why it matters: IAM, PAM, and NHI teams need to treat external delivery paths and delegated access as part of one attack surface because compromised credentials and trusted channels can both initiate infection.

Context

Rhadamanthys is a modular information stealer that operates as malware-as-a-service, which means multiple threat actors can buy, adapt, and deploy it through different delivery paths. In this article, the security problem is not the malware family alone but the way trusted delivery channels, exposed credentials, and user-triggered execution combine to bypass ordinary trust assumptions.

For identity and access teams, the important point is that malware delivery increasingly rides on the same trust relationships that identity programmes already manage: compromised websites, sign-in flows, and access to cloud and email environments. That makes this a governance problem for non-human identities as much as a detection problem for endpoint teams.

Key questions

Q: What breaks when malware delivery depends on user-triggered execution from trusted-looking sites?

A: The main failure is that traditional perimeter and content filters assume the user is viewing information, not initiating code execution. Once the lure depends on copy-paste commands, fake updates, or sign-in-style prompts, the trust boundary shifts to the browser and the user interface. Controls must address the execution path, not only the payload.

Q: Why do compromised websites and malvertising increase identity risk for security teams?

A: Because they let an attacker borrow the appearance of legitimate delivery and use it to harvest credentials, tokens, or execution rights. That turns a web trust issue into an identity issue when the site is used to trigger login-like behaviour, session theft, or malware installation. Security teams need to treat delivery trust as part of access governance.

Q: How can teams tell whether they are exposed to Rhadamanthys-style stealer campaigns?

A: Look for campaign patterns that combine branded lures, external verification pages, downloader activity, and follow-on script execution. If the same environment allows users to click through to arbitrary sites and run locally initiated commands, the exposure is already there. Behavioural detection matters more than matching one malware sample.

Q: What should organisations do after a stealer campaign uses compromised delivery infrastructure?

A: They should assume the same delivery route can be reused with different payloads and reviewers may have already accepted the site as trustworthy. The response should focus on revoking exposed credentials, validating which domains were used, and tightening controls around user-driven execution before the next campaign reappears.

Technical breakdown

How Rhadamanthys turns delivery channels into execution paths

Rhadamanthys is distributed through several initial delivery patterns, including email links, compromised websites, malvertising, and ClickFix lures that persuade the target to run a command locally. The technical pattern matters because the malware often does not need a direct exploit against the endpoint. Instead, the attacker uses trusted web content or a socially engineered prompt to move the user from viewing content to executing code, often through PowerShell or a staged loader. That collapses the distinction between content delivery and code execution. In practice, this makes the delivery layer part of the attack chain, not just a prelude to it.

Practical implication: treat web and email delivery paths as executable attack surfaces, not just content channels.

Why modular MaaS design changes the defender's problem

Rhadamanthys is sold as a modular Malware-as-a-Service package, with plugins, staged loaders, and evolving evasion features that let affiliates tailor campaigns to different targets. A modular design lets operators separate distribution, initial foothold, credential theft, and follow-on payload delivery across multiple components, which makes detections harder to generalise. The article also describes packaging changes such as obfuscation, anti-analysis features, and loader chains that distribute responsibility across actors. That means defenders are not dealing with one fixed payload but with a market of variants that reuse the same campaign logic while changing technical signatures.

Practical implication: build detections around behaviour and chain patterns, not just a single hash or file name.

How compromised websites and malvertising become identity problems

When compromised websites or malvertising serve Rhadamanthys, the website owner may not be the attacker, but the trust relationship is still exploited. The user encounters a legitimate-looking site, a fake verification step, or a branded lure, and then follows instructions that trigger malware installation. In identity terms, this is a trust boundary failure: the user treats an external domain as implicitly reliable because it resembles a normal access path. That is why compromised third-party web infrastructure matters to IAM and NHI governance. Once the attack begins with a trusted channel, downstream identity controls have less opportunity to intervene.

Practical implication: inventory which trusted external domains can trigger user execution or credential capture in your environment.

Threat narrative

Attacker objective: The attacker wants to steal credentials and sensitive information while preserving a flexible delivery ecosystem that supports repeated campaigns.

1. Entry occurs through email links, compromised websites, malvertising, or ClickFix instructions that persuade the victim to run a malicious command or open a staged payload.
2. Credential harvest or data theft follows once the stealer is installed, because Rhadamanthys is designed to collect login data, financial information, and system details.
3. Impact is the theft of credentials and sensitive data, followed by potential follow-on access through the compromised accounts and the reuse of stolen infrastructure.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Compromised delivery channels are now part of identity governance, not just threat infrastructure: Rhadamanthys shows that a trusted website, a malicious ad, or a convincing sign-in lure can become the start of an identity compromise chain. The governance failure is not only in the malware itself but in how much implicit trust organisations still assign to third-party delivery surfaces. Practitioners should treat external delivery trust as an access-control problem, not only a web-filtering problem.

Identity trust debt is the right concept for this pattern: once users are conditioned to follow verification prompts, copy commands, or complete sign-in-like flows on external sites, the environment accumulates trust debt that attackers can spend repeatedly. That debt spans human identity controls, email security, and the exposed non-human identities behind hosting, redirect, and campaign infrastructure. The implication is that trust review must extend to the delivery path as well as the credential itself.

Rhadamanthys demonstrates how malware-as-a-service lowers the cost of identity abuse: modular loaders and affiliate campaigns let lower-skill operators borrow sophisticated delivery mechanics without building them from scratch. That widens the pool of actors who can turn stolen credentials, browser sessions, or cloud-adjacent access into operational compromise. The practitioner conclusion is that the relevant control boundary is no longer the endpoint alone but the combination of identity, browser, and delivery infrastructure.

Operation Endgame matters because disruption changes the reuse economics, not the underlying control gap: takedowns can suppress infrastructure and frustrate affiliates, but they do not remove the trust relationships that made the campaigns effective. The same organisational blind spots around external delivery, user-triggered execution, and credential capture remain available to the next stealer family. The field needs governance that assumes the delivery layer is adversarial by default.

Compromised websites are a third-party NHI problem in disguise: the article shows actor-operated infrastructure, loader domains, and redirect services being chained into campaign delivery. Those components behave like ephemeral non-human identities with no durable accountability unless organisations actively govern them. The operational lesson is to track the identity and ownership of delivery infrastructure, not just the payload it serves.

What this signals

Identity trust debt: when users can be pushed from a trusted-looking page into local code execution, the real control failure is not just phishing. It is the accumulation of delivery paths that are implicitly trusted long after their assurance value has expired, which means browser policy, email hygiene, and external-domain review need to be governed as one programme.

For NHI teams, the article is a reminder that loader domains, redirect services, and actor-operated infrastructure behave like disposable non-human identities. If those identities are not inventoried, attributed, and retired quickly, they become reusable transport for the next stealer family rather than one campaign artifact.

For practitioners

• Map user-execution lure paths Identify which email, browser, and web-verification flows can lead a user from trusted content to command execution or file download. Prioritise paths that rely on copy-paste instructions, fake updates, or sign-in-style prompts.
• Hunt for staged loader chains Look for multi-stage delivery patterns that combine a loader, a follow-on payload, and a stealer. Chain-aware detections are more useful here than single-file signatures because the payload mix changes across campaigns.
• Review third-party delivery trust Catalogue hosted sites, ad networks, and redirectors that can present content to your users without strong identity assurance. Treat compromised websites and malvertising as identity-adjacent ingress points, not just nuisance traffic.
• Tighten browser and script execution controls Limit local script execution paths that attackers rely on in ClickFix-style lures, especially PowerShell and other user-driven interpreters. Combine this with logging that preserves the origin of the trigger, not only the executed process.

Key takeaways

• Rhadamanthys matters because malware delivery now blends social engineering, compromised websites, and identity trust into one operational chain.
• The article shows repeated use of email, malvertising, and ClickFix-style lures, which makes the delivery path as important as the payload itself.
• Security teams need to govern trusted external delivery surfaces and user-driven execution together, or stealer campaigns will keep finding a path in.

Key terms

• Malware As A Service: A subscription-based criminal model where attackers rent access to malware, infrastructure, and operator tooling instead of building everything themselves. It industrialises delivery and support, which makes abuse more repeatable and the associated identity and access paths harder to distinguish from legitimate services.
• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Compromised website: A legitimate site that an attacker has altered or injected with malicious content, often without the owner’s knowledge. In identity terms, it is a trusted external surface whose apparent legitimacy lets the attacker deliver malware or harvest credentials with less resistance.
• Infostealer Malware: Infostealer malware is designed to quietly capture credentials, browser sessions, cookies, and other authentication artifacts from an endpoint. It creates downstream identity risk because the stolen data often remains usable even after the initial infection is removed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.