Rhadamanthys malware, compromised NHIs, and what IAM teams should watch

TL;DR: Rhadamanthys has evolved into a modular information stealer delivered through email, compromised websites, malvertising, and ClickFix social engineering, while law enforcement disruptions under Operation Endgame have also hit its infrastructure and affiliates, according to Proofpoint. The case reinforces that exposed credentials, user-triggered execution, and infrastructure reuse turn identity and delivery channels into a single attack surface.

NHIMG editorial — based on content published by Proofpoint: Rhadamanthys malware analysis and the impact of Operation Endgame

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: How should security teams defend against malware campaigns that rely on fake verification pages and pasted commands?

A: Treat the browser, the clipboard, and the command shell as one attack path.

Q: Why do modular malware-as-a-service campaigns create a broader identity risk than a single stealer binary?

A: They let multiple affiliates reuse the same delivery and exfiltration ecosystem with different payload combinations, targets, and timings.

Q: What breaks when security teams focus only on attachment scanning and ignore staged delivery chains?

A: Attachment scanning misses the point when the lure merely starts a chain that later loads a stealer from external infrastructure.

Practitioner guidance

• Harden user-execution choke points Monitor for copy-paste execution, PowerShell spawns from browsers, and fake verification pages that precede script launch.
• Correlate delivery infrastructure across campaigns Group incidents by redirect domains, intermediate hosts, and loader reuse instead of treating each lure as isolated.
• Tighten controls around exposed credentials Assume stolen secrets will be tested almost immediately after exposure and prioritise rapid revocation, scope reduction, and reuse monitoring for any account or token that can reach external services.

What's in the full report

Proofpoint's full article covers the operational detail this post intentionally leaves for the source:

• Campaign-level examples of Rhadamanthys delivery through email, compromised websites, PDFs, and malvertising.
• Indicator sets and emerging threat signatures that can be used to tune detection and blocking.
• The operation-focused disruption context behind Operation Endgame and the infrastructure targets it affected.
• Campaign and loader observations that help teams map how affiliates reuse delivery chains across incidents.

👉 Read Proofpoint's analysis of Rhadamanthys delivery chains and Operation Endgame →

Rhadamanthys malware, compromised NHIs, and what IAM teams should watch?

Explore further

View Full Forum →  |  NHI Foundation Course →