Threats · 53 days ago

Fake Updates Hide Espionage Inside Normal Trust

JadeProx is getting in by looking like software people already trust. The danger is not a single malicious file, but the fact that a fake installer or update can carry the first stage past casual review and hand off to follow-on tools from there.

Group-IB tied the campaign to a new Windows loader, TriBack Loader, used against government, healthcare, and education targets across Asia and Latin America. The lures included lookalike vendor-style domains and a fake Claude installer, with multiple builds relying on signed binaries, DLL sideloading, and persistence through normal Windows startup behavior.

That shifts the problem from endpoint filtering alone to the trust model around downloads, installers, and update paths. If those paths are easy to impersonate, the initial foothold can arrive already wrapped in legitimacy.

Timeline

• Jul 23 Reported by The Hacker News
• Nov 17 CISA federal deadline for CVE-2021-31755 passed
• Nov 3 CVE-2021-31755 added to CISA KEV

Sources

1 source covering this story

• The Hacker News Jul 23

  China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

  JadeProx uses the new TriBack Loader against government, healthcare, and education targets through DLL sideloading and a fake Claude installer.

Entities

• CVE-2018-11511
• CVE-2021-24139
• CVE-2021-31755
• CVE-2021-32305
• JadeProx

Part of the PlainSec briefing for 2026-07-24

Editions

• Briefing for 2026-07-24
• Briefing for 2026-07-23

Related stories

• Browser Traffic Becomes the Command Channel