Loading story…
Cybercriminals have significantly increased the use of concealed JavaScript and steganography to deliver malware through business-themed email attacks in the third quarter of 2025. Security researchers at Forcepoint X-Labs observed a surge in malicious emails disguised as legitimate business communications, such as purchase orders, shipment notifications, and payment requests. These emails often contain compressed archive attachments (ZIP, RAR, 7z, or TAR) that include heavily obfuscated JavaScript files. The obfuscation is designed to evade detection by security tools, making it difficult for traditional email filters to identify the threat. Once a recipient opens the JavaScript file, it leverages legitimate Windows utilities like PowerShell and Windows Management Instrumentation (WMI) to execute commands, a technique known as 'Living off the Land' (LotL). This approach allows attackers to operate without raising immediate suspicion or triggering standard security alerts. A notable aspect of these campaigns is the use of steganography, where malicious code is hidden within seemingly innocuous image files. The JavaScript downloader decodes Base64-encoded DLL or EXE payloads embedded in these images, further complicating detection. Payloads identified in these attacks include well-known malware families such as Agent Tesla, Remcos RAT, DarkCloud, and FormBook, each capable of stealing sensitive information or providing remote access to compromised systems. The campaigns are highly targeted, with lures localized in multiple languages, including English and Spanish, to increase their effectiveness against non-English speaking businesses. Subject lines like “RE: Payment Swift MT103” and “DHL Shipment Notification” are commonly used to entice recipients into opening the attachments. The sophistication of these attacks, including the use of legitimate system tools and advanced concealment techniques, allows them to bypass many conventional security defenses. Security experts recommend organizations implement advanced email filtering, strengthen endpoint security, and conduct regular user awareness training to mitigate the risk. The trend highlights the evolving tactics of threat actors who continuously adapt to evade detection and maximize the impact of their campaigns. Organizations are urged to remain vigilant and update their security protocols to address these emerging threats. The use of steganography in malware delivery represents a significant challenge for defenders, as it requires more advanced analysis to uncover hidden payloads. The ongoing evolution of these attack methods underscores the importance of a multi-layered security approach. Businesses are advised to monitor for unusual activity related to PowerShell and WMI, as these are commonly abused in such attacks. The widespread nature of these campaigns suggests that organizations of all sizes and sectors are at risk. Collaboration between security vendors and enterprises is essential to develop effective countermeasures. The research underscores the need for continuous threat intelligence sharing to stay ahead of rapidly changing attack techniques. Ultimately, the rise in JavaScript and steganography-based malware delivery marks a new phase in email-borne threats, demanding heightened awareness and proactive defense strategies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Campaigns observed in this period delivered malware families including Agent Tesla, Remcos RAT, DarkCloud, and FormBook through the concealed JavaScript and steganography techniques. Shipment-notification themed emails were among the social engineering lures used to infect targets.
By Q3 2025, attackers were using Windows Management Instrumentation and PowerShell to execute commands after victims opened the malicious JavaScript. They also hid malicious code inside image files using steganography to further evade detection.
During the third quarter of 2025, researchers observed a significant increase in malware delivered through JavaScript files concealed inside compressed archives. The lures commonly arrived via malicious emails masquerading as purchase orders, quotes, and shipment notifications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple sophisticated malware campaigns have been identified targeting organizations and individuals across various regions, utilizing advanced loader techniques and evasion tactics. Notable threats include AuraStealer, a malware-as-a-service infostealer distributed via social media scams and cracked software, capable of stealing data from a wide range of browsers and applications, and employing anti-analysis features such as geolocation checks and virtual machine detection. CloudEyE, another malware-as-a-service downloader and cryptor, has seen a dramatic increase in detections, serving as a delivery mechanism for other malware like Rescoms, Formbook, and Agent Tesla, and leveraging multi-stage delivery tactics to avoid detection. Additionally, a commodity loader has been used in targeted email campaigns against manufacturing and government sectors, employing weaponized documents, steganography, and multi-layered evasion pipelines to distribute remote access trojans and infostealers. The Tuoni C2 malware framework was used in a stealthy attack against a major U.S. real estate firm, utilizing AI-generated code, steganography, and memory-only execution to evade detection and maintain long-term access for credential theft and potential ransomware deployment. These campaigns highlight a trend toward modular, evasive malware delivery systems that leverage commodity loaders, steganography, and malware-as-a-service models, enabling threat actors to efficiently compromise targets while minimizing forensic footprints. Security researchers emphasize the need for advanced detection and prevention strategies to counter these evolving threats, as traditional security layers are increasingly bypassed by modern malware techniques.
Jun 29, 2026
Security researchers reported multiple malware delivery chains that **hide or embed executable payloads inside image files** to evade detection. Veracode analyzed a malicious typosquatted NPM package, `buildrunner-dev`, that uses a `postinstall` hook to run `init.js`, which downloads an obfuscated batch script (`packageloader.bat`) from a Codeberg repository. The batch script ultimately retrieves PNG images hosted on a free image service and extracts hidden data from RGB pixel values (steganography), leading to a loader with **process hollowing**, **encrypted payload handling**, **AMSI bypass**, and per-AV evasion logic, culminating in deployment of the **Pulsar .NET RAT**. Separately, SANS ISC documented a phishing/malspam-style infection chain starting from an Excel attachment exploiting **CVE-2017-11882** (Equation Editor), which downloads an HTA that launches PowerShell to fetch a PNG (`optimized_MSI.png`) containing a Base64-encoded .NET payload delimited by `BaseStart-` and `-BaseEnd` tags. The handler noted **reuse of the same image across campaigns**, used VirusTotal similarity searches to identify many related samples, and produced a YARA rule to track the technique. Kaspersky’s write-up on **Arkanix Stealer** describes a MaaS stealer ecosystem (C++ and Python variants, ChromElevator usage, and broad credential/crypto theft) but does not center on image-based payload hiding, making it a separate topic from the image-steganography delivery chains described by Veracode and SANS ISC.
Jun 29, 2026
Threat actors are increasingly adopting sophisticated email phishing techniques that leverage both established and novel methods to bypass security controls and deceive users. One prominent trend is the use of PDF attachments in phishing emails, where attackers embed QR codes within the PDF files. This tactic encourages recipients to scan the QR code with their mobile devices, which often lack the robust security protections of corporate endpoints, thereby increasing the likelihood of successful credential theft or malware installation. In addition to QR codes, attackers are also distributing password-protected PDF attachments. The passwords are either included in the email or sent separately, which not only complicates automated scanning by security solutions but also lends an air of legitimacy to the communication, making recipients more likely to trust and open the files. These methods represent a resurgence and refinement of older phishing tactics, demonstrating the adaptability of threat actors in response to evolving security measures. Another significant development is the deployment of SVG image attachments as phishing lures, as seen in the Tykit phishing kit. This kit, identified as part of a phishing-as-a-service (PhaaS) operation, uses SVG files that mimic secure document viewers or prompt users to enter information, such as the last four digits of their phone number, under the guise of accessing secure content. The SVG files contain embedded JavaScript that redirects victims through a series of intermediary pages, ultimately leading to a fake Microsoft 365 login page designed to harvest credentials. The infrastructure supporting these attacks is highly organized, with command-and-control (C2) servers identified by unique URL patterns and attack flows that include adversary-in-the-middle (AitM) techniques to intercept and replay stolen credentials. The Tykit campaign has targeted hundreds of victims across multiple sectors, including finance, IT, government, professional services, and construction, with a notable concentration in the United States, Canada, and Southeast Asia. Activity associated with this campaign peaked in the latter half of 2025, indicating a surge in the adoption of these advanced phishing methods. The use of both PDF and SVG attachments in phishing campaigns highlights the ongoing arms race between attackers and defenders, as threat actors continuously refine their techniques to evade detection and exploit user trust. Security teams are challenged to adapt their defenses to account for encrypted attachments, QR code-based lures, and sophisticated image-based phishing kits. The prevalence of phishing-as-a-service offerings further lowers the barrier to entry for cybercriminals, enabling widespread and coordinated attacks. Organizations are urged to enhance user awareness, implement advanced email filtering, and monitor for emerging phishing tactics that leverage non-traditional attachment types and multi-stage attack chains. The evolving landscape of email phishing underscores the need for a multi-layered security approach that addresses both technical and human vulnerabilities.
Jun 29, 2026