A notorious cyberespionage group called "FamousSparrow" has updated its backdoor to infiltrate Central and South American governments and major industries. "The fact that they used it indicates that they were genuinely committed to avoiding detection." Stack spoofing involves manipulating a thread's call stack, causing potentially sensitive function calls to appear as though they originated from a legitimate program.

Another advantageous aspect of the modular SparroWocky is its capability to integrate Beacon Object Files (BOFs) – a file format initially introduced by Cobalt Strike and subsequently adopted by other penetration testing developers.

Colette Côté emphasizes, "This enables them to benefit from a significant portion of the offensive security community's advancements – to effectively repurpose these modules originally designed for red teaming and apply them within their own malware." FamousSparrow not only gains access to more open-source (OSS) red teaming tools through BOF compatibility, but they can also incorporate these tools into their malware framework. Since August 2025, SparrowWocky has primarily targeted government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, as well as a telecommunications firm in Puerto Rico.

For example, one Panamanian entity we've observed being targeted is directly involved in the ongoing commercial dispute over two major ports located in the canal area, which were previously operated by a China-based company.