Loading story…
HP Wolf Security reported a targeted malware campaign against the African banking sector in which an employee of a West African bank was lured with a fake recruitment email sent from typosquatted banking domains. The attackers cloned banking websites and used domains configured with SPF to make the messages appear more trustworthy, increasing the likelihood of successful delivery and user engagement.
The infection chain used HTML smuggling to reconstruct a Base64-encoded ISO file from an HTML attachment on the victim’s device, helping the payload evade email and web filtering. Opening the ISO exposed a malicious VBS script that launched PowerShell and executed shellcode from the Windows Registry in memory; that shellcode decrypted to GuLoader, which was configured to fetch a RemcosRAT payload from cloud services including OneDrive and Dropbox.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
In early 2022, HP Wolf Security detected a targeted campaign against an employee of a West African bank using a fake job recruitment lure sent from typosquatted banking domains. The infection chain used HTML smuggling to deliver an ISO containing a VBS script that launched PowerShell shellcode, decrypted to GuLoader, and fetched RemcosRAT from cloud-hosted URLs.
A WHOIS lookup showed that the primary typosquatted domain used in the campaign was registered in December 2021. HP also identified additional related typosquatted domains used to support the operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026
Researchers reported that malicious email attachments disguised as JavaScript files were being used to deliver a broad set of remote access Trojans and stealers through heavily obfuscated loader chains. HP Wolf Security identified the activity as **RATDispenser**, a stealthy JavaScript loader that decodes itself, launches `cmd.exe`, writes a VBScript file into `%TEMP%`, and then either drops or downloads a second-stage payload. Analysis of 155 samples found that **94%** acted as droppers rather than network downloaders, with **STRRAT** and **WSHRAT** making up **81%** of observed payloads; other delivered malware included **Formbook**, **Remcos**, **AdWind**, **Panda Stealer**, **GuLoader**, and **Ratty**. The campaign’s low average detection rate and layered obfuscation indicated an effective distribution mechanism for commodity malware. Separate analysis of a phishing campaign targeting European organizations showed a similar JavaScript-to-VBS infection pattern delivering **H-Worm/Houdini** after emails impersonating entities such as **UNWTO** and **IATA**. Lab52 attributed that operation to **LazyScripter** and found that the attackers’ obfuscated scripts had themselves been tampered with by the online service `hackfree.org`, which injected an additional **njRAT** downloader, creating a double-compromise scenario. Researchers linked the primary campaign to infrastructure including `stub.ignorelist.com` and `securessl.fit`, while the injected secondary activity used a PowerShell downloader that contacted `185.81.157.186` to retrieve content from `/NDA/199.png`, underscoring how obfuscated JavaScript loaders were being reused to distribute multiple RAT families through phishing.
Aug 15, 2026