The RedDrip Team of the QiAnXin Threat Intelligence Center has identified a supply chain attack involving the official installer for a virtual mobile service provider, which occurred between February and late March 2026. During this period, the installer was compromised, leading to substantial breaches affecting various government and enterprise endpoints. The method of attack featured a malicious installer designed as a multi-layer Trojan loader, dubbed GGBond Rat, which exploited the compromised installer framework. The command and control (C2) domain associated with this threat was noted to be hosted on Cloudflare CDN and ranked among the top 1 million domains on OpenDNS.