New Lua-based malware LucidRook observed in targeted attacks against Taiwanese organizations

Cisco Talos observed a spear-phishing attack delivering LucidRook, a newly identified stager that targeted a Taiwanese NGO in October 2025. The metadata in the email suggests that it was delivered via authorized mail infrastructure, which implies potential misuse of legitimate sending capabilities.

Pulse ID: 69d65cbe07a5f680cde16920
Pulse Link: https://otx.alienvault.com/pulse/69d65cbe07a5f680cde16920
Pulse Author: AlienVault
Created: 2026-04-08 13:48:46

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #CyberSecurity #Email #InfoSec #LUA #Malware #OTX #OpenThreatExchange #Phishing #SpearPhishing #Talos #bot #AlienVault