Phishing Campaigns Abuse Trusted Platforms and Tools to Deliver Remote Access Malware

Multiple reports describe phishing-led malware delivery that abuses trusted services and “living off the land” execution paths to evade controls and deploy remote access tooling. Cloudflare-tracked activity shows attackers using Vercel-hosted pages to lend legitimacy to malicious links and bypass email/security filtering, with lures themed around invoices, payments, shipping, and document portals; the infrastructure includes Telegram-based filtering and browser fingerprinting/conditional delivery to hinder researchers and sandboxes before serving payloads that install a remote access tool (RAT).

A separate campaign (tracked as PHALT#BLYX) targets hospitality staff with Booking[.]com-style reservation emails and uses a fake browser error + fake BSOD to coerce victims into running the ClickFix technique (Win+R paste/execute), launching PowerShell that pulls malicious project files and executes them via MSBuild.exe to deliver DCRat, consistent with LOLBins-based evasion; researchers noted Russian-language artifacts in the malware. Broader weekly/newsletter roundups also highlight the same risk theme—attackers increasingly blend social engineering with trusted infrastructure and tools—while mixing in unrelated items (e.g., firewall CVEs, general malware research links) that are not part of a single, specific incident narrative.