GhostFrame Malware Targets VMware ESXi for VM Hijacking and Credential Theft
A new toolkit named GhostFrame allows attackers with existing root access to VMware ESXi hosts to hijack virtual machines and steal Windows credentials, operating below the VM level to evade detection.
A novel toolkit dubbed GhostFrame has emerged, providing attackers with a unified control panel to compromise VMware ESXi hosts and the virtual machines (VMs) they manage. Researchers from Recorded Future's Insikt Group identified this framework while monitoring threat actor TAG-218, whose activities show overlap with the Settra ransomware group. Notably, GhostFrame can exfiltrate Windows credentials from VMs without deploying any malware directly within the guest operating system, significantly complicating detection efforts.
The primary advantage of GhostFrame lies in its operation at the hypervisor level. By gaining root access to the ESXi host, attackers can bypass security solutions deployed within individual VMs, as these tools typically lack visibility into the underlying hypervisor. The framework does not rely on exploiting a specific vulnerability to gain initial access; instead, it requires pre-existing root privileges on the ESXi host.
Once installed, GhostFrame establishes persistence by modifying critical boot scripts, specifically /etc/rc.local.d/local.sh, to ensure its continuous operation after reboots. It also disables the ESXi firewall and the execInstalledOnly setting, which normally restricts the execution of unsigned programs. These security measures are repeatedly re-enabled by administrators are quickly reverted by the malware, creating a persistent state of vulnerability.
GhostFrame disguises its implant as a legitimate VMware process, renaming itself vmhostd to blend in with the system's normal operations. The malware attempts to establish a command-and-control (C2) connection using six different network ports, prioritizing the first successful connection. This behavior can manifest as a burst of connection attempts from a single ESXi host, serving as a potential indicator for security monitoring.
Beyond persistence and C2 communication, GhostFrame offers a suite of capabilities for VM manipulation. Operators can list VMs, alter their power states, create or delete snapshots, and enable VNC remote access. It can also expose the ESXi HTML Host Client, the web-based management interface for the hypervisor, and includes a SOCKS5 proxy tool named gfsox for pivoting into internal networks.
The credential theft capabilities are particularly concerning. A component called sdkmon intercepts and captures ESXi login credentials. Furthermore, GhostFrame incorporates VMkatz, an open-source tool that can extract sensitive information from VM memory snapshots, disk images, and datastore scans. This includes NTLM hashes, WDigest credentials, Kerberos tickets, SAM and LSA secrets, and NTDS.dit data, effectively allowing attackers to steal Windows credentials without ever entering the guest VM.
Insikt Group's investigation linked TAG-218's activities, including the use of GhostFrame and MeshCentral for persistent access, to attacks against VPN devices in late 2026, with some victims later appearing on the Settra ransomware leak site. This aligns with recent exploitation patterns where attackers leverage VPN vulnerabilities to gain initial access and then pivot to the virtualization layer, as seen in the exploitation of a Palo Alto Networks GlobalProtect flaw (CVE-2026-0257) which allowed credential dumping from VMware disks.
Organizations are advised to secure their ESXi environments by restricting management access to trusted systems, monitoring for unauthorized root logins and configuration changes, and scrutinizing modifications to boot scripts. Network traffic analysis for unusual connection patterns and prompt patching of VPN devices are also crucial. The emergence of GhostFrame underscores the importance of treating hypervisors as critical infrastructure, demanding the same level of security scrutiny as domain controllers.