TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents

Key takeaways The TAOTH campaign leveraged an abandoned Sogou Zhuyin IME update server and spear-phishing operations to deliver multiple malware families-including TOSHIS, C6DOOR, DESFY, and GTELAM-primarily targeting users across Eastern Asia. Attackers employed sophisticated infection chains, such as hijacked software updates and fake cloud storage or login pages, to distribute malware and collect sensitive information. [...]