UAT-8302 Uses Custom Malware and Open-Source Tools to Steal Data From Government Agencies

'What started as someone potentially trying to remove the background from a selfie ended with a custom .NET stealer rifling through their browser passwords': Experts warn that free image editor tool could actually be dangerous malware

Background removal services are being used in ClickFix attacks, delivering dangerous infostealer malware.

UAT-8302 Uses Custom Malware and Open-Source Tools to Steal Data From Government Agencies

A sophisticated China-linked hacker group known as UAT-8302 has been quietly targeting government agencies across South America and southeastern Europe, using a mix of custom malware and widely available open-source tools to steal sensitive data. The group has been active since at least late 2024 and stepped up its operations against government bodies in southeastern Europe through 2025. Their goal is clear: get in, stay hidden, and walk out wit…