Loading story…
Researchers documented several multi-stage malware campaigns delivering remote-access trojans including NetSupport RAT, Agent Tesla, Remcos RAT, and CastleRAT/NightShadeC2 through obfuscated scripts, phishing lures, and malicious installers. One NetSupport intrusion used Microsoft SafeLinks redirection, intermediary URLs, obfuscated JavaScript, and hidden PowerShell to fetch ZIP payloads via BITS, then launched client32.exe from an %AppData%\aragdrts folder and established persistence through scheduled tasks, Startup entries, and Registry Run keys. Separate analyses of Agent Tesla and Remcos samples showed BAT, CMD, JavaScript, and PowerShell stages that decoded or decrypted .NET payloads, with Agent Tesla configured for credential theft, keylogging, screen capture, and SMTP-based exfiltration, while Remcos included functions to disable Microsoft Defender and persist by copying its launcher into the Windows Startup path.
A later intrusion report showed how these commodity malware chains are being used for immediate fraud operations rather than only initial access. In that case, a malicious CarrierRegistration.msi delivered Matanbuchus, then NetSupport RAT, Remcos RAT, and finally CastleRAT, which was used to harvest browser credentials and proxy the victim’s live browser session into financial-site login attempts from the compromised host. The activity indicates a shift from simple information theft toward hands-on-keyboard account takeover, where attackers exploit stolen sessions and local browser context directly to evade fraud controls tied to device, IP, and session reputation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The malicious extension identified as version 2.2 with ID flkebkiofojicogddingbdmcmkpbplcd was removed from the Chrome Web Store, though installed copies could remain on affected systems and synced profiles.
Microsoft warned about a malicious Chromium-based extension, "Search for perplexity ai," that impersonated Perplexity AI and redirected browser searches through attacker-controlled infrastructure, exposing search traffic and related metadata.
Between December 4 and December 11, 2025, the actor harvested browser credentials and used CastleRAT to proxy the victim's live browser session for attempted logins to financial-institution websites. The report characterized the activity as account takeover-focused monetization rather than ransomware deployment or broader lateral movement.
On December 4, 2025, a multi-stage intrusion started with a malicious MSI file named CarrierRegistration.msi delivering the Matanbuchus loader, followed by NetSupport RAT, Remcos RAT, and CastleRAT. The operation targeted a real-estate-themed deception environment.
A malware analysis documented a Remcos RAT infection chain using an obfuscated CMD script, PowerShell, AES decryption, and Gzip decompression to recover .NET executables. The report identified persistence via the Windows startup path and noted functions for disabling Microsoft Defender, along with related hashes and network indicators.
An analysis traced an Agent Tesla sample from a BAT file through obfuscated PowerShell and .NET payloads to a final information-stealing and keylogging implant that exfiltrated data via SMTP. The report also listed hashes, delivery infrastructure, and email addresses associated with the activity.
A report described a phishing campaign delivering NetSupport RAT through Microsoft SafeLinks abuse, intermediary redirects, obfuscated JavaScript, and PowerShell. The analysis published domains, URLs, IPs, hashes, filenames, and persistence details tied to the campaign.
A blog post analyzed an Agent Tesla Windows executable sample obtained from Malware Bazaar and documented capabilities including credential harvesting, keylogging, screen capture, host discovery, and likely email-based data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourceblog.deception.pro
Open sourcemedium.com
Open sourcemedium.com
Open sourcemedium.com
Open sourcedenwp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Multiple reports detail **social-engineering-driven malware delivery** that results in **remote access trojans (RATs)** and credential theft. Infoblox described observing an affiliate push-notification ad network after exploiting misconfigured DNS delegations (“**Sitting Ducks**”/lame name server delegation) to take over abandoned threat-actor domains, allowing collection of **~57M logs** over two weeks and visibility into widespread **scams and brand impersonation** delivered via push ads. Nextron Systems separately reported recurring **malvertising** chains where “free converter” tools (e.g., document/image converters) downloaded from ads on legitimate sites function as advertised while covertly installing **persistent RATs**, with common artifacts such as Windows **Mark-of-the-Web** (`ZoneId=3`) indicating internet origin. Other activity in the set reflects different initial-access lures but the same general outcome—RAT-style access and data theft. Fortinet analyzed a **phishing** campaign using a fake Vietnam shipping document: a Word attachment leads to an RTF stage that exploits an RTF-related vulnerability, then uses **VBScript/PowerShell** to load a **fileless .NET module**, ultimately downloading and injecting a **Remcos** variant (including process hollowing) to provide full remote control. Separately, reporting on North Korea’s **“Contagious Interview”** campaign described fake recruiter outreach (e.g., via LinkedIn) that tricks developers into opening malicious code repositories; execution can be triggered via a hidden **VS Code `tasks` configuration**, server-side logic hooks, or a malicious npm dependency to steal credentials/crypto wallets and establish persistence—this is thematically similar (social engineering leading to remote access) but is a distinct operation from the malvertising/push-ad and Remcos phishing activity.
Jun 29, 2026