Trojanised FACEIT, Zoom, Webex and other installers spread Starland malware (UAT-11795)
Cisco Talos found fake installers for Zoom, Webex, FACEIT, MobaXterm and DBeaver installing Starland malware on Windows PCs, which steals passwords and crypto wallets. Download only from official sites and don't paste commands you don't understand. No arrests found.
Download Zoom, Webex, FACEIT and similar apps only from the maker's official site or app store, and never paste or run a command a web page tells you to. If you ran an unknown installer, scan the PC, change passwords from a clean device and move any crypto to a new wallet.
What’s happening
In July 2026 Cisco Talos described a campaign by a Russian-speaking, financially motivated group it tracks as UAT-11795, active since at least June 2025. The group distributes trojanised installers that imitate MobaXterm, Cisco Webex, Zoom, DBeaver Community Edition and the FACEIT gaming platform. Talos suspects, but could not confirm, that victims are lured by a ClickFix-style prompt that runs a remote script. The installers load Starland, a Python remote access trojan, in memory. Starland looks for more than 40 cryptocurrency wallets, takes screenshots and survives restarts. It can also bring in a PowerShell implant called WLDR and further malware, including the CastleStealer infostealer and Remcos. BleepingComputer reports CastleStealer targets browser credentials, wallets, and Discord and Telegram sessions. Victims are mainly in the US, with some in Germany, Romania and Venezuela. CERT-EU also listed the campaign in its August brief. There is no software fix because this is a malware campaign rather than a flaw. Talos published detection signatures. As of 3 November 2026 we found no report of arrests, a takedown or a later update.
- What
- Scam
- Affects
- Windows PCs; fake Zoom, Webex, FACEIT, MobaXterm and DBeaver installers
- Fixed in
- Nothing to patch
- Since
- 16 July 2026
- Closed
- 3 Aug 2026
Timeline
- Update
CERT-EU's July 2026 cyber brief listed the campaign as affecting users in the US and Europe, including Germany and Romania. It describes theft of credentials and cryptocurrency and further payload delivery.
- Update
BleepingComputer reported the findings. It said the follow-on infostealer CastleStealer targets Discord and Telegram sessions, browser credentials and crypto wallets. It noted no arrests or takedown.
- Made publicNothing to patch
Cisco Talos published research on UAT-11795, a Russian-speaking, financially motivated group active since at least June 2025. It distributes trojanised installers posing as MobaXterm, Cisco Webex, Zoom, DBeaver and FACEIT, which install the Starland remote access trojan and a PowerShell implant called WLDR.
Sources
- UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaignCisco Talos · 16 July 2026
- Russian hackers trojanize Webex, Zoom apps to push Starland malwareBleepingComputer · 16 July 2026
- Cyber Brief 26-08 (July 2026)CERT-EU · 3 Aug 2026