These are three separate security stories, not one coordinated operation. Contemporary reports said Singtel found and removed malware in June 2024, but the company could not confirm an alleged Volt Typhoon connection. Cado Security Labs documented GuLoader spear-phishing aimed at industrial organizations in Europe and Kazakhstan. LastPass warned that scammers were using fake Chrome Web Store reviews to publish fraudulent support numbers.
A later Singapore disclosure about a UNC3886 campaign against all four major telcos, and a January 2026 LastPass vault-backup scam, are separate developments and should not be folded into the original 2024 stories.
As an Amazon Associate I earn from qualifying purchases.
Singtel: a reported malware incident, not a confirmed Chinese hack
Contemporary reporting said Singtel detected malware in June 2024 and eradicated it. Singtel said it reported the incident to relevant authorities, found no evidence of stolen data, and saw no impact on telecommunications services.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reports from sources familiar with the matter alleged a link to Volt Typhoon, a threat actor commonly associated with Chinese state interests. Singtel itself said it could not confirm that attribution. The most accurate description is therefore “a June 2024 Singtel malware incident with an alleged Volt Typhoon connection,” not a confirmed Chinese hack.
#1 Best Overall
What the 2024 account establishes
- Detection occurred in June 2024.
- Singtel said the malware was removed.
- The operator said it notified relevant authorities.
- Singtel reported no stolen data and no service disruption.
- The Volt Typhoon attribution remained unconfirmed by Singtel.
The separate UNC3886 disclosure in 2026
On 9 February 2026, Singapore’s Cyber Security Agency and Infocomm Media Development Authority described a later campaign attributed to UNC3886. Authorities said it targeted all four major Singapore telcos—M1, SIMBA Telecom, Singtel and StarHub.
The official account said the attackers reached parts of telco networks. In one instance, they used a zero-day exploit to bypass a perimeter firewall; another part of the campaign involved advanced tools, including rootkits. Authorities reported limited access to critical systems in one case and exfiltration of a small amount of primarily network-related technical data. They said there was no evidence to date that sensitive or personal customer records had been accessed or that telecommunications services had been disrupted.
The response operation lasted more than 11 months and involved over 100 cyber defenders. Those figures describe the later UNC3886 operation, not the June 2024 incident, and the disclosure does not confirm the earlier Volt Typhoon allegation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How GuLoader targeted industrial and engineering employees
Cado Security Labs described spear-phishing aimed at employees of electronic manufacturing, engineering and industrial organizations in Romania, Poland, Germany and Kazakhstan. The messages could arrive from fake companies or compromised accounts, hijack an existing thread, or pose as an inquiry about an order.
The lure and attachment
The emails carried compressed archives, including ISO, 7z, gzip or RAR files. Opening the archive exposed a batch file containing obfuscated PowerShell. An order-themed message is especially plausible in manufacturing and engineering environments, where employees routinely exchange drawings, purchase documents and delivery information.
The analyzed execution chain
- Batch file: The initial file launched obfuscated PowerShell.
- Shellcode: A second script allocated memory and executed shellcode.
- Process injection: The shellcode was injected into the legitimate
msiexec.exeprocess. - Persistence: The chain created a registry key to survive beyond the initial execution.
- Payload retrieval: The injected code attempted to contact a domain for another payload. In Cado’s sample, that request returned HTTP 404 at the time of analysis.
Process injection lets malicious code run inside a normal-looking Windows process. As Cado threat research lead Tara Gould explained, that can make detection harder because security products and users may see a legitimate process rather than an obviously malicious executable.
What GuLoader does—and what this sample proves
Cado highlighted process injection, junk code, encrypted shellcode and anti-analysis measures as GuLoader evasion techniques. Earlier GuLoader campaigns commonly used the loader to deliver remote-access trojans such as Remcos, NetWire or AgentTesla. Those are known possible payloads, not confirmed payloads in every target incident. In the analyzed chain, the final retrieval returned 404, so the evidence does not show that one of those trojans was successfully installed.
LastPass fake-support scams: two campaigns with different lures
Fake Chrome Web Store reviews in 2024
LastPass’s 31 October 2024 advisory said attackers were posting fake reviews on the LastPass Chrome Web Store page. The reviews advertised fraudulent customer-support phone numbers. In a 6 November update, LastPass said the actors had begun disguising the number with emojis and had changed the number while leaving the destination website unchanged.
LastPass directed customers to its official website and support channels. It also stated that its staff will never ask for a user’s master password. A phone number displayed in an app-store review is not proof that the caller is affiliated with the vendor.
The separate January 2026 vault-backup phishing campaign
Beginning around 19 January 2026, another campaign sent emails claiming that maintenance was imminent and that recipients had to back up their vaults within 24 hours. LastPass explicitly said it was not asking customers to perform such a backup. The deadline was a social-engineering tactic designed to push people toward a phishing link.
On 22 January, LastPass reported another wave using changed links after the original infrastructure was disrupted, along with related lookalike domains. Those domains and links are historical indicators; they should not be treated as a permanently current block list without fresh validation.
Recommended Free Tools
Quick Recap
How the three stories differ
| Story | Primary target | Initial access or lure | Evidence described | Timeline |
|---|---|---|---|---|
| Singtel malware incident | Telecommunications infrastructure | Reported malware intrusion | Operator statement and contemporary attribution reporting | June 2024 incident; Volt Typhoon link unconfirmed |
| GuLoader campaign | Employees at industrial, engineering and electronic-manufacturing organizations | Order inquiries or thread-hijacked emails with archive attachments | Threat-research analysis of an execution chain | Reported in 2024; analyzed payload retrieval returned 404 |
| LastPass fake-support campaign | Password-manager customers | Fake Chrome Web Store reviews and fraudulent phone numbers | Vendor advisory and update | 31 October and 6 November 2024 |
| LastPass vault-backup campaign | Password-manager customers | Urgent maintenance and 24-hour backup emails | Vendor advisory | January 2026 |
Practical precautions
For telecom and infrastructure teams
- Keep incident attribution separate from technical facts until investigators publish supporting evidence.
- Record whether an event affected services, exposed customer data or only reached network-management systems.
- Preserve forensic evidence and coordinate promptly with national cyber authorities.
For industrial organizations
- Treat unsolicited order documents and unexpected thread replies as suspicious, even when they appear to come from a known supplier.
- Block or quarantine archive formats that users do not need for their roles, and inspect nested files before release.
- Monitor PowerShell, registry persistence and unusual child processes involving
msiexec.exe. - Use application controls and endpoint telemetry capable of detecting code injection into trusted processes.
For LastPass customers
- Reach support through the vendor’s official website rather than a phone number in a store review or unsolicited email.
- Never disclose a master password to “support.”
- Do not act on a demand to back up a vault within 24 hours; verify the message through an independently opened official channel.
- Be cautious with lookalike domains and changed links, since campaign infrastructure can move after takedowns.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
