Loading story…
Breakglass Intelligence reported an active campaign using a custom AsyncRAT fork dubbed PhishingRAT, attributed to a Vietnamese-speaking cybercriminal operator. Investigators linked at least 12 samples built around lure themes including PhishingRAT, RobloxHack, and Spotify, and identified live, Cloudflare-fronted command-and-control infrastructure at alam[.]it[.]com, datadreamers[.]in[.]net, sc88[.]now, and indotech[.]it[.]com. The malware retained standard AsyncRAT capabilities such as keylogging, remote control, persistence via registry Run keys and scheduled tasks, and data exfiltration, while also adding HTTP flood functionality, aggressive persistence, and behavior intended to disable Microsoft Defender.
The campaign’s defining feature was a sandbox pollution engine that generated large volumes of fake malicious activity instead of simply terminating in analysis environments. Researchers observed simulated phishing POSTs, SQL injection, ransomware actions, credential theft, fake credit-card submissions, crypto-mining, port scanning, and other decoy behaviors designed to overwhelm PCAPs and automated detections while concealing genuine RAT traffic. Attribution was supported by multiple operational security failures, including a leaked Vietnamese-language debug PDB path, Debug builds, plaintext configuration data, weak hardcoded AES keys, reused mutexes, and the campaign label TestVT, suggesting repeated testing against VirusTotal.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Breakglass Intelligence published analysis of the PhishingRAT variant, highlighting a sandbox-confusion engine that generated fake malicious behaviors to pollute analysis, along with added HTTP flood, persistence, and Defender-disabling features. The report also cited OPSEC failures including a Vietnamese-language PDB path, Debug builds, weak AES keys, and the "TestVT" label, attributing the activity to a Vietnamese-speaking financially motivated operator with medium-to-high confidence.
A 38 KB .NET malware sample later identified as a modified AsyncRAT variant was recovered from MalwareBazaar. Analysis tied it to the same campaign and showed it used live C2 infrastructure over port 443.
Investigators observed an active AsyncRAT campaign between March 7 and March 10, 2026 using a custom fork dubbed "PhishingRAT." At least 12 samples were linked across PhishingRAT, RobloxHack, and Spotify lure themes, using Cloudflare-fronted C2 domains datadreamers[.]in[.]net, sc88[.]now, indotech[.]it[.]com, and live infrastructure at alam[.]it[.]com.
Breakglass reported that the command-and-control domain alam[.]it[.]com was freshly registered and moved behind Cloudflare, with no prior public threat intelligence reporting. This infrastructure change preceded later malware sample discoveries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Researchers detailed a phishing campaign that used an **SVG attachment** to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows `search-ms` handler with a **WebDAV** path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with **Pyarmor 9**, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted **RC4-protected shellcode**, allocated executable memory, and launched a multi-stage sequence that included a **laZzzy-generated injector** targeting `notepad.exe`, more shellcode, and final **.NET malware** delivering **DcRat, AsyncRAT, XWorm RAT, and PureHVNC**. The tradecraft closely matches activity previously attributed to **DDGroup**, a long-running cybercrime actor tied to phishing campaigns that weaponize `search-ms` and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including **XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader**, along with dynamic DNS infrastructure, open-source tooling such as **Freeze.rs** and **dufs**, and repeated process injection into `notepad.exe`. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to **URLhaus** to speed blocking.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026