Phishing Lures Deployed PowerShell-Based Infostealers for Credential and Data Theft

Phishing emails and malicious websites were used to trick users into launching PowerShell-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed msedge.exe spawning powershell.exe, followed by curl.exe, a downloaded DLL, and rundll32.exe; the decoded Base64 command used an IEX and Net.WebClient.DownloadString pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an AgentTesla variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download.

A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of updater.exe, a packed PyInstaller-based DXI Infostealer sample. The malware used a UAC bypass via the ms-settings registry hijack and computerdefaults.exe, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with rar.exe before exfiltrating them through the Telegram API as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.