Netskope Threat Labs

MirrorBlast

ATP Sandbox Adv. Heuristics

MirrorBlast is a trojan that attacks users' browsers by posing as a legitimate browser add-on, and later versions install additional malware alongside it. Researchers noted tentative links between the campaign and the TA505 and PYSA groups.

First seen
May 2022
Last seen
September 2026
Mirrorblast
Alert Name
Document-Excel.Trojan.Mirrorblast
Document-Office.Trojan.Mirrorblast
Document-OLE.Trojan.Mirrorblast
Win32.Trojan.Mirrorblast
Win32.Trojan.MirrorBlast