Loading story…
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented Remcos RAT, DesckVB RAT, and a Rust-based COVERT RAT being delivered through ZIP attachments, weaponized LNK files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as aspnet_compiler.exe, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included 192.3.27.141:8087, 172.245.246.77:8080, and 181.231.253.69:4444, while observed artifacts included C:\ProgramData\remcos\logs.dat, C:\ProgramData\colors\logs.dat, and payload names such as ALTERNATE.dll, ClassLibrary3.dll, Keylogger.dll, and msedge_proxy.exe.
Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable AnyDesk instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to Rare Werewolf (Librarian Ghouls). Securonix research cited by Trojan Killer described VEIL#DROP using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy PureLog Stealer, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Seqrite linked a phishing campaign targeting Russian aerospace and aviation organizations to the Rare Werewolf (Librarian Ghouls) threat actor. The campaign used invoice-themed emails and spoofed domains to deploy portable AnyDesk for unattended access, establish persistence with a scheduled task, hide activity with Tray Minimizer, and exfiltrate configuration data via a command-line SMTP mailer.
Securonix Threat Research detailed VEIL#DROP, a multi-stage Windows malware delivery chain using deceptive JavaScript files, PowerShell download cradles, Blogspot staging, XOR-protected data, and in-memory .NET execution to deploy PureLog Stealer. The campaign was described as stealing browser credentials, cookies, session tokens, wallet data, and host information.
A joint report by YesWeHack and Sekoia described ChocoPoC, a Python RAT hidden in fake GitHub proof-of-concept repositories for newly disclosed vulnerabilities and used repeatedly since late 2025 to target vulnerability researchers and pentesters. The malware was reported as still active as of 2026-07-01, using malicious dependencies such as frint and skytext, persistence via trojanized Python packaging components, and infrastructure including 91.132.163.78:8001 for exfiltration.
Point Wild reported on DesckVB RAT, a JavaScript-initiated, fileless .NET RAT active in 2026 that uses PowerShell, reflection, Base64 encoding, and string reversal to load modules in memory. The report identified infrastructure and payload components including pastee.dev, hostgator and Synology domains, ClassLibrary3.dll, ClassLibrary1.dll, Microsoft.exe, and Keylogger.dll.
Point Wild analyzed a phishing campaign in which a ZIP attachment disguised as a business document led to obfuscated JavaScript, PowerShell execution-policy bypass, retrieval of ENCRYPT.Ps1, and in-memory loading of ALTERNATE.dll. The activity abused aspnet_compiler.exe as a LOLBin, communicated with C2 at 192.3.27.141:8087, fetched an additional payload, and created C:\ProgramData\remcos\logs.dat.
Point Wild described Operation Covert Access, a spear-phishing campaign using judicial-themed lures against Argentina’s judicial sector to deliver a Rust-based RAT. The infection chain used a ZIP archive with a weaponized LNK, BAT loader, and PDF decoy, with the malware connecting to 181.231.253.69:4444 and supporting persistence, credential theft, encryption, and privilege escalation.
Point Wild reported on a newer Remcos RAT variant that uses runtime API decryption, encrypted configuration and C2 traffic, dynamic module loading, and direct exfiltration. The report identified indicators including C2 endpoint 172.245.246.77:8080, mutex Rmc-GSEGIF, and artifact C:\ProgramData\colors\logs.dat.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetrojan-killer.net
Open sourcetrojan-killer.net
Open sourcepointwild.com
Open sourcepointwild.com
Open sourcepointwild.com
Open sourcepointwild.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026