Direct answer
Check the installer source before assuming the legitimate apps are unsafe
Cisco Talos found a financially motivated campaign distributing malicious installers named for Webex, Zoom, MobaXterm, DBeaver, and Faceit. Teams do not need to uninstall legitimate copies obtained through official channels solely because of this report. They should review where recent installers came from, compare suspicious files and security alerts with Talos’s published indicators, and isolate any device that ran an unknown-source installer or matches an indicator. Talos did not report that the vendors’ official download systems were compromised, and it has not confirmed the initial infection vector.
What professionals should do now
Choose the lane that matches the evidence
Delete and reacquire
Delete the untrusted copy, reacquire the software from the vendor’s official download page, and let your organization’s normal endpoint controls scan it before execution.
Isolate the device
Disconnect or isolate the device and hand it to your incident-response process. Preserve the installer and relevant alerts for investigation instead of cleaning away evidence first.
Treat it as a credible signal
Isolate first, investigate scope and persistence, then rotate credentials and revoke sessions under the response plan after containment.
What Cisco Talos Found
The campaign uses installer filenames that imitate familiar software. Talos’s public indicator file includes hashes tied to files named MobaXterm_v26.1.exe, WebEx_Client.exe, two DBeaver installer variants, a Zoom installer, and a Faceit installer. A familiar filename is a lure identity, not proof that the legitimate product or vendor download site was breached.
Talos says the chain can deploy Starland RAT, a newly documented remote-access trojan; WLDR, a bespoke PowerShell command-and-control implant; CastleStealer; and Remcos. Reported capabilities include browser and credential theft, cryptocurrency targeting, screenshots, remote commands, system discovery, and Active Directory reconnaissance. That combination makes installer provenance an operational issue for IT, database, support, and remote-access teams, not merely a consumer download warning.
Official-source map
Where to Reacquire the Professional Tools Named in the Campaign
These vendor pages are acquisition paths, not a remote verdict on a file already on your device. If an installer was executed from an unknown source, use the containment lane rather than assuming a clean reinstall resolves the incident.
MobaXterm
Talos lists a malicious hash for a file named MobaXterm_v26.1.exe. Mobatek’s official page currently identifies its available editions and download host.
Webex
Talos lists a malicious hash for a file named WebEx_Client.exe. Use Cisco’s Webex download page or your organization’s managed deployment.
Zoom
Talos lists a malicious hash labeled as a Zoom installer. Use Zoom’s own Download Center or your organization’s managed software catalog.
DBeaver Community
Talos lists two malicious hashes for DBeaver-style Windows installer names. DBeaver publishes its current packages and checksums on its own download page.
TPTK decision framework
How to Check a Recent Installer Without Guessing
- 1
Record where it came from
Capture the download URL, referring page, email or chat context, download time, filename, and the user or automation that obtained it. A search ad, forum, file-sharing link, or copied URL is not equivalent to the vendor page.
- 2
Preserve and hash a suspicious file
If your security process permits, preserve the file without executing it and calculate its SHA-256 value with approved tooling. Compare the result with Cisco Talos’s maintained IOC file rather than relying on the filename alone.
- 3
Review signature and security telemetry
A valid digital signature, endpoint alert, download reputation result, process tree, and network activity can add context. No single signal should override a confirmed malicious hash or credible endpoint detection.
- 4
Reacquire through a controlled source
Use the vendor’s official page, a managed software catalog, or your organization’s packaging system. For teams, document the approved route so the same search-and-download exposure does not repeat.
Evidence boundary: TPTK is recommending a provenance-and-telemetry check. It is not claiming that a different hash automatically proves a file is safe, or that the named vendors’ official systems distributed the malicious files.
If a Suspicious Installer Already Ran
Disconnect or isolate the device using your established endpoint or network process. Do not keep using it to log in to business systems while you investigate.
Preserve the installer, endpoint alerts, process and network telemetry, and the user’s account of what happened. Have the security owner or provider check for the Talos-published payload and infrastructure indicators, persistence, credential access, lateral movement, and activity on other devices.
Because Talos describes credential theft and remote-control capabilities, credential resets and session revocation may be necessary. Sequence those actions through the incident plan after containment so an active implant cannot simply capture replacement credentials. A clean reinstall can be part of recovery, but uninstalling the imitated app alone does not establish that the payload and persistence are gone.
What Is Known, What Is Analysis, and What Remains Unknown
UAT-11795 used trojanized installer lures and deployed Starland RAT, WLDR, CastleStealer, and Remcos. Talos published file and infrastructure indicators plus ClamAV and Snort detection references.
The useful team decision is not whether a product name appears in a headline. It is whether a recent installer came through an approved source, was executed, or matches campaign evidence.
Talos did not confirm the initial infection vector, official vendor infrastructure compromise, a victim count, or that every file using one of these names is malicious.
TPTK will update this permanent URL if Talos changes the campaign scope, indicators, detection guidance, or infection-vector assessment, or if a named vendor publishes a material primary-source advisory.
Starland RAT FAQ
Does Starland RAT mean Webex or Zoom’s official apps were hacked?
No. Cisco Talos reported malicious installers using familiar product names; it did not report that Webex, Zoom, MobaXterm, DBeaver, Faceit, or their official download systems were compromised. Obtain software from the vendor’s official page or your organization’s managed catalog.
Who should act on the Starland RAT report now?
Anyone who recently downloaded one of the named installers from an unofficial or unknown source should check the file and source. If the installer ran, or a Talos indicator or endpoint alert matches, isolate the device and begin the organization’s incident-response process.
Is uninstalling and reinstalling enough after running a suspicious installer?
No. Talos describes separate credential-stealing and remote-control payloads, so removing the imitated application does not prove the payload or persistence is gone. Isolate the device, investigate scope, and recover it through the incident-response plan.
Can a filename prove that an installer contains Starland RAT?
No. Attackers can copy a legitimate filename. Source provenance, a cryptographic hash compared with Talos’s indicators, digital-signature context, endpoint telemetry, and investigation provide stronger evidence.
Update Log
July 16, 2026 at 5:50 AM PDT: Initial publication. Cisco Talos report, public IOC file, professional-tool acquisition paths, response boundaries, images, links, and schema verified.
Sources
- Cisco Talos: UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant. Published July 16, 2026; accessed July 16, 2026.
- Cisco Talos public indicators for the Starland RAT and WLDR campaign. Accessed July 16, 2026.
- Mobatek: MobaXterm official download page. Accessed July 16, 2026.
- Webex official downloads. Accessed July 16, 2026.
- Zoom official Download Center. Accessed July 16, 2026.
- DBeaver Community official download page. Accessed July 16, 2026.
- BleepingComputer: Russian hackers trojanize Webex, Zoom apps to push Starland malware. Published July 16, 2026; accessed July 16, 2026.
Primary technical claims and indicators come from Cisco Talos. Vendor pages are used only for official acquisition paths. BleepingComputer is corroboration; its discussion of a possible ClickFix route is not treated as confirmed.
Editorial note: This authority-only security alert contains no affiliate links, Amazon bounty module, or incident-response service offer. Material corrections or source changes will be recorded in the update log.