A Rust-based remote access trojan called CikaBika Bot uses Discord to issue commands, collect system details and control infected Windows computers. The reported infection chain attempts to plant a malicious DLL in the Microsoft Edge installation directory, although researchers did not confirm that Edge successfully loaded it.
SecurityAffairs reported the campaign on October 18, 2026, citing research by Darktrace. The report does not tie the activity to a vulnerability or CVE, and the initial delivery method remains unconfirmed.
A fake document leads to PowerShell and a Nim loader
The chain begins with a disk image named Proposition_Projet.img. It contains a Windows shortcut disguised as a Word document and a PDF that appears to be a legitimate French-language document about writing summaries.
According to the report, opening the shortcut launches a hidden PowerShell process while displaying the PDF as a distraction. PowerShell then reads the PDF as raw data and uses a concealed value as a decryption key to recover a Nim-based loader in a temporary directory.
That loader carries two further components:
- A DLL written in Rust
- A PowerShell script used to prepare the DLL for sideloading
The script copies the Rust DLL into the Microsoft Edge installation folder and names it dbghelp.dll, matching a legitimate debugging library that Edge may load. Darktrace characterized the method as DLL search-order hijacking.
The same script reportedly changes a Windows registry setting and abuses computerdefaults.exe to write into the protected directory without displaying a User Account Control prompt.
This is an attempt to misuse Edge as a host process, not a reported security flaw in Edge itself.
Researchers did not confirm successful DLL loading
The sideloading stage has a significant technical limitation. As quoted by SecurityAffairs, Darktrace found that the planted DLL does not export every function listed in Edge’s delay-import table. The malicious library may therefore be incompatible with the host on some systems.
Darktrace said the code demonstrates the intended execution route, but does not establish that Edge actually loaded the planted dbghelp.dll. The later RAT behavior should consequently be understood as conditional on the implant executing successfully.
The report also assesses the disk image, disguised shortcut and plausible PDF as signs of a phishing design. That remains an assessment rather than confirmation of how the files reached prospective victims.
Discord becomes a separate control channel for each host
Once running, CikaBika Bot registers the compromised computer through Discord and creates a dedicated channel for that device. It then gathers host information, executes tasklist and ipconfig, captures a screenshot and sends the results back through the channel.
The reported command set allows an operator to:
- Open a remote shell
- List and terminate processes
- Upload and download files
- Take screenshots
- Access the camera
- Stream the screen
Discord functions as the command-and-control channel, allowing the operator to manage devices and retrieve results without maintaining a conventional C2 server. For larger data transfers, the malware reportedly uses ngrok, reducing its reliance on Discord for exfiltration while retaining Discord for interactive control.
What defenders can look for
Because the report identifies behaviors and filenames rather than campaign-specific hashes or service identifiers, defenders should correlate multiple events instead of treating any single filename or application as proof of compromise.
Useful investigation points include:
- Execution of a
.lnkfile presented as a Word document from a mounted disk image - Hidden PowerShell activity immediately after the shortcut opens
- PowerShell reading a PDF as raw data or writing an executable into a temporary directory
- Unexpected placement or modification of
dbghelp.dllinside the Microsoft Edge installation folder - Registry changes and unusual use of
computerdefaults.exenear writes to the Edge directory tasklist,ipconfigand screenshot activity followed by Discord communications- Discord and ngrok traffic from an endpoint showing the preceding execution chain
The name dbghelp.dll is also used by legitimate software, so its presence alone is not sufficient. File origin, signature, creation time and surrounding process activity provide the necessary context.
Organizations encountering Proposition_Projet.img or the described shortcut chain should isolate the affected endpoint and examine the Edge installation directory, PowerShell history, registry activity and outbound Discord or ngrok connections. Since no CVE is involved in the report, detection must focus on the lure, script execution, protected-directory write and attempted DLL sideloading rather than a vulnerability-specific patch.
