Actor designator
EGGCOP
Designated by Cassandra Quill · First observed October 2025
Summary
EGGCOP is a Vietnamese commercial cybercrime cluster operating an infostealer monetisation pipeline. The cluster takes its name from the operator company, eggcop.com, identified through self-exfiltration of the operators' own administration workstations. Initial access uses double-extension PDF.EXE lures distributed through LinkedIn and other social channels. Payload encoding stacks Base32, bzip2, zlib, and Python bytecode before resolving to a Donut shellcode loader that performs DPAPI credential theft from Chromium, Edge, Firefox, and the Vietnamese-localised CocCoc browser. Exfiltration is one-way Telegram sendDocument traffic. Stolen credentials, cookies, autofill data, and Facebook business-account sessions feed a parallel dropshipping fraud operation run by the same corporate front.
Sector
Consumer browsers, dropshipping merchant accounts, regional banking, social ad-account operators, cryptocurrency wallets
Region
Global, with material targeting skew toward Korean, Taiwanese, and Israeli users. 845 victim packages catalogued across 60-plus countries.
Attribution
Vietnamese commercial cybercrime operator (high confidence). Operators self-identified through self-infection of their own administration workstations on an FPT Telecom subscriber range in Ho Chi Minh City. Operator company is eggcop.com, registered 2016, eight named staff mailboxes confirmed.
First observed
October 2025
Defensive ask
Treat unsolicited LinkedIn approaches that arrive with executable attachments as the leading consumer-side initial-access risk. Block double-extension file delivery at email and chat gateways. Add Telegram sendDocument egress monitoring with the published bot token and channel ID as named indicators. For consumer hygiene: never store passwords in the browser, use a hardware-backed password manager, and treat any saved-in-browser credential on a once-infected device as already compromised.
Coverage
- EGGCOP cluster: Vietnamese commercial infostealer ring identified through operator self-infection
A 2.9 GB Telegram exfiltration archive places 845 credential-theft packages and the operators themselves in Ho Chi Minh City. The cluster operates a corporate front, eggcop.com, with eight identified staff mailboxes and one strongly attributed individual operator.
- EGGCOP Has Pivoted Its Bait Vector. The LinkedIn Approach Has Been Joined by a Conference Channel.
The Vietnamese-aligned cluster I track as EGGCOP has pivoted. The LinkedIn approach is now joined by a second vector working through industry conference registration channels. The defensive read has shifted.
- EGGCOP Is Running LinkedIn Bait Against Israeli Users. The Tradecraft Tells You Where It Lives.
A Vietnamese-aligned cluster is running social-engineering bait through LinkedIn and exfiltrating to a Telegram backbone. The targeting is heavily skewed toward Israeli users. The operators have made tradecraft mistakes worth understanding.
About designators on this site. Actor designators in the EGGCOP family are assigned by Cassandra Quill and are not industry-standard names. Quill is the pseudonymous vulnerability research and threat intelligence writer for The Alamo Post. Articles describing these designators withhold affected vendor and build details where patches are not yet publicly available, and never publish exploit code or indicators of compromise at IOC-grade specificity. Defensive guidance is the focus.