Cybersecurity experts have identified a new Russian-led cyber campaign targeting Ukrainian organizations, involving two previously unknown malware families, BadPaw and MeowMeow. The attack starts with a phishing email containing a link to a ZIP file, which delivers a fake Ukrainian border crossing document to deceive victims. Behind the scenes, the malware checks the system’s age to avoid detection, then silently downloads additional malicious components, including a backdoor that allows attackers to remotely control infected devices. Evidence suggests Russian involvement, as the malware often includes Russian language clues. In addition, a new phishing tool called Starkiller has emerged, capable of creating highly convincing fake login pages that bypass multi-factor authentication. Starkiller uses advanced techniques like real-time proxying and headless browsers to steal login information and session tokens, making it easier for cybercriminals to hijack accounts and launch large-scale attacks. CTIX analysts will continue to report on the latest malware strains and attack methodologies.