Loading story…
Researchers reported a malware campaign using obfuscated VBS and PowerShell stages hosted across multiple DuckDNS domains to infect 64-bit Windows systems with a remote access trojan. The chain decrypts an AES-256-protected PowerShell stage, extracts a 64-bit payload, and uses a .NET helper to hollow AppLaunch.exe for stealthy execution. The malware then establishes persistence through the Windows Startup folder and attempts to weaken defenses by adding Microsoft Defender exclusions.
The RAT communicates with suspected command-and-control infrastructure over port 4577 and is designed for credential theft and surveillance. Reported capabilities include stealing browser credentials and cookies, keylogging, clipboard capture, remote control, and local storage of stolen data, raising the risk of account takeover and broader compromise of enterprise sessions and sensitive information. The reporting includes hashes, filenames, domains, an IP address, and filesystem paths as indicators of compromise, with defenders urged to block the infrastructure, hunt for suspicious PowerShell activity, and isolate affected hosts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Threat researcher Anurag identified a malware campaign that uses obfuscated VBS and AES-256-protected PowerShell stages to deliver a 64-bit Windows remote access trojan via multiple DuckDNS hosts. The observed chain includes process hollowing into AppLaunch.exe, persistence via the Startup folder, Defender exclusion attempts, and C2 communications on port 4577.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious email campaign delivered the **MoDi RAT** through a multi-stage, largely fileless infection chain that relied on VBScript, PowerShell, Registry-stored payloads, and process injection. The attack began with an email attachment that triggered HTTP `302` redirects to a OneDrive-hosted ZIP archive, then established persistence with a **Scheduled Task** and stored payload components in the Windows Registry rather than on disk. Sophos reported that some artifacts contained French-language strings and that some of the targeted organizations were French firms. The intrusion used an unusual evasion technique in which a VBS script opened PowerShell and pasted commands into the console through the clipboard and `SendKeys`, reducing the visibility of command-line activity to security tools. PowerShell then extracted and reflectively loaded a .NET decoder from the Registry, unpacked an injector and the final payload, and injected the RAT into `msbuild.exe` without writing the malware to disk. Sophos said **AMSI telemetry** helped detect and block the attack, while noting that AMSI-based protections are available only on newer Windows platforms including **Windows 10** and **Windows Server 2016/2019**.
Aug 14, 2026
Researchers detailed a phishing campaign that used an **SVG attachment** to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows `search-ms` handler with a **WebDAV** path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with **Pyarmor 9**, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted **RC4-protected shellcode**, allocated executable memory, and launched a multi-stage sequence that included a **laZzzy-generated injector** targeting `notepad.exe`, more shellcode, and final **.NET malware** delivering **DcRat, AsyncRAT, XWorm RAT, and PureHVNC**. The tradecraft closely matches activity previously attributed to **DDGroup**, a long-running cybercrime actor tied to phishing campaigns that weaponize `search-ms` and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including **XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader**, along with dynamic DNS infrastructure, open-source tooling such as **Freeze.rs** and **dufs**, and repeated process injection into `notepad.exe`. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to **URLhaus** to speed blocking.
Aug 15, 2026
Researchers detailed an ongoing **Snip3 crypter** malware campaign that used spear-phishing emails themed as tax statements to launch a multi-stage infection chain. The attacks began with obfuscated **VBScript** and **PowerShell** downloaders that retrieved additional components from remote infrastructure including SQL-backed command sources and public text-hosting services, then established persistence through startup-folder VBS files. Later stages gathered host information, communicated with download servers over HTTP POST, and decrypted further payloads directly in memory to reduce detection. The final Snip3 stage dynamically compiled C# **RunPE** code with CodeDom and used **process hollowing** to inject remote-access trojans into legitimate Windows processes including `AppLaunch.exe`, `RegAsm.exe`, and `regsvcs.exe`. Analysis across samples showed the framework delivering both **DcRAT** and **QuasarRAT**, with one examined payload identified as DcRAT through artifacts including its mutex naming, X.509 certificate fields, and the AES salt string `DcRatByqwqdanchun`. The reporting indicates Snip3 remains an adaptable loader for concealing commodity RATs behind layered scripting, in-memory decryption, and changing command-and-control infrastructure.
Aug 15, 2026