Hexastrike Blog
FLEXRAT – ChilloutVR Lures, Shared Secrets, and an OPSEC Hangover
Executive Summary Hexastrike uncovered an undocumented commodity stealer and remote access toolset, which we track as FLEXRAT, distributed through counterfeit game-modification websites. The most prominent lure infrastructure impersonates the ecosystem surrounding ChilloutVR, a legitimate social VR platform, and advertises downloadable mods and plugins purported to extend the game’s functionality. The campaign relies on search-driven delivery. Lure sites are positioned to capture users searching for terms such as “ChilloutVR Mods” and “ChilloutVR Plugins”, while their consistent design and game-themed domain names
STORESOCKS – Microsoft Store Apps Deliver a Go Backconnect Proxy
Executive Summary Hexastrike uncovered an ongoing backconnect proxy campaign distributed through trojanized Microsoft Store applications. We track this activity as STORESOCKS. Since at least October 2025, an unknown actor has published trojanized free utility applications to the Microsoft Store. The applications impersonate common desktop tools, including WinDirStat, Lightshot, screen recorders, memory cleaners, and auto-clickers. They are not broken decoys or simple launchers. Each analyzed Store package contains a working Electron-based utility interface that matches the advertised purpose of the application. In
CodeStorm – A Microsoft 365 AiTM Phishing Kit with Storm-1167 Overlap
Executive Summary Hexastrike has identified an ongoing adversary-in-the-middle (AiTM) phishing campaign targeting Microsoft 365 users that leverages a previously undocumented phishing kit, tracked by Hexastrike as CodeStorm. Analysis of the recovered server-side kit source code and associated deployment infrastructure indicates with moderate confidence that CodeStorm overlaps with infrastructure patterns previously associated with activity Microsoft tracks as Storm-1167. Based on direct code-level comparison conducted by Hexastrike, CodeStorm appears to be a distinct kit family separate from previously documented phishing frameworks such