New GhostFrame Malware Lets Hackers Hijack VMware ESXi VMs and Steal Windows Credentials
New GhostFrame malware allows attackers to hijack VMware ESXi servers and steal Windows credentials.
A new toolkit named GhostFrame enables attackers to control VMware ESXi servers and their virtual machines, with capabilities to steal Windows credentials without installing malware inside the guest VMs. Researchers discovered the framework while tracking a group named TAG-218, which has connections to Settra ransomware. The tool operates by gaining root access to the ESXi host and then disabling security features, allowing it to persist across reboots and establish command and control.
AI summary of the linked source. Not reviewed by an editor. How this works
Run VMware ESXi?
Get an email when a new story names VMware ESXi, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe GhostFrame toolkit demonstrates how gaining root-level access to a VMware ESXi hypervisor can compromise every virtual machine running on it, without ever touching the guest OS — bypassing traditional endpoint security entirely. The attackers disabled security features at the hypervisor level and established persistence across reboots, meaning standard remediation steps like rebooting a VM would not remove the threat. This matters because hypervisors are high-value, often under-monitored targets: compromise one, and you effectively own the entire virtualized estate. Organizations frequently harden guest VMs while neglecting the security posture of the underlying hypervisor host itself.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — GhostFrame
- malware — vmhostd-core
- malware — VMkatz
- ip — 2222
- ip — 3389
- ip — 4444
- ip — 8443
- ip — 9443
- malware — gfsox
- malware — sdkmon