GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

Threat actors believed to be linked to Dark Caracal deployed a new malware framework called GoCaracal during an intrusion at a Venezuelan communications organization. The GoCaracal malware provides remote shell access and allows for payload execution. It also has an extended profile that enables additional capabilities, including stealing browser data, keylogging, and controlling remote desktops. The malware was used in an incident that occurred in June 2026. GoCaracal is a previously undocumented framework written in Go.