Cybersecurity researchers have identified multiple campaigns relating to a new malware dubbed “PLAYFULGHOST”. PLAYFULGHOST’s capabilities overlap with the Gh0st RAT remote access tool, designed to act as backdoor and to steal sensitive information. Attackers either use phishing emails or SEO poisoning to coax victims into downloading a trojanized version of a legitimate VPN application like LetsVPN. The delivery of PLAYFULGHOST can be sophisticated, as researchers noted an execution scenario in which a Windows shortcut combines the contents of two other files to construct a rogue DLL required to load the final payload. PLAYFULGHOST establishes persistence in victim environments via the Run registry key, scheduled task, Windows Startup folder, and Windows service. The malware can gather and exfiltrate data including keystrokes, screenshots, audio, QQ account information, and clipboard content. The malware can also drop additional payloads, clear Windows Event Logs, delete caches and profiles associated with web browsers, and erase profiles and local storage of messaging applications. Other forms of malware that have been deployed via PLAYFULGHOST include Mimikatz, a rootkit, and a utility called Terminator that can kill security processes. Researchers note that these campaigns are likely targeting Chinese-speaking Windows users based on the targeting of popular Chinese-language applications such as Sogou, QQ, and 360 Safety. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.