Cybersecurity researchers have attributed an ongoing infostealer malware campaign to a threat actor termed CoralRaider. CoralRaider is a financially motivated threat actor group of suspected Vietnamese origin known for mainly targeting victims in Asian and Southeast Asian countries. The recent malware campaign has also been seen targeting countries such as the U.S., Germany, Poland, Japan, and Ecuador among others. The campaign is designed to deliver infostealer malware including LummaC2, Rhadamanthys, and Cryptbot. The attack begins with a Windows shortcut file, which could be delivered via phishing or malvertising. The shortcut file contains PowerShell commands that grab an obfuscated HTML Application (HTA) file from the CDN cache of an attacker-controlled subdomain to avoid request delays and deceive network defenders. The HTA file contains JavaScript which includes a PowerShell decrypter and loader. The PowerShell loader drops scripts on the victim’s machine to evade detection by configuring a Windows Defender exclusions list and bypassing User Access Controls. The PowerShell loader drops the final infostealer payload into the location previously specified to be excluded from Windows Defender scanning. The infostealer malware used in this campaign are recent versions available via malware-as-a-service platforms on underground forums. Attackers behind these infostealers can profit from the stolen information such as user credentials, RDP logins, and browser session cookies by selling to other malicious actors for gaining initial access. CTIX analysts will continue to report on novel and evolving malware and associated campaigns.