OTX Threat: ClickFix-Themed Campaign Deploys Starland RAT and WLDR Framework

A Russian-speaking, financially motivated threat actor designated UAT-11795 has been conducting a sophisticated malware campaign since June 2025, primarily targeting users in the United States. The operation utilizes ClickFix-style social engineering techniques with trojanized software installers for applications like MobaXterm, Cisco WebEx, Zoom, DBeaver, and FACEIT. The campaign deploys Starland CVEs: CVE-2017-7921, CVE-2021-21974, CVE-2021-3493, CVE-2022-21894, CVE-2021-4034 Sectors: Finance