Loading story…
Researchers reported an active AVE_MARIA malware campaign delivering the infostealer through phishing lures and multi-stage, stealth-focused execution chains. In one observed intrusion, a malicious VBScript and PowerShell sequence loaded a Revenge RAT reconnaissance component directly into memory from paste.ee, then launched a downloader that performed process hollowing against RegAsm.exe before executing AVE_MARIA. The malware also used a UAC bypass via PkgMgr/DISM DLL hijacking for privilege escalation and communicated with 194.5.98[.]139, infrastructure previously tied to Orcus RAT activity, suggesting overlap with an actor behind earlier Orcus campaigns.
Separate reporting shows the malware family has also been distributed through phishing attachments disguised with an icon resembling AhnLab V3 Lite, alongside AgentTesla payloads. Those samples used a .NET packer to hinder detection, delayed execution with timeout.exe, abused winSAT.exe, escalated privileges with a winmm.dll-based UAC bypass, and likewise injected malicious code into RegAsm.exe. Across the observed campaigns, AVE_MARIA operators have combined social engineering, in-memory staging, privilege escalation, and trusted Windows binaries to evade defenses and steal victim data.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
ASEC released detection names, MD5 hashes, and network indicators associated with the V3 Lite icon masquerade campaign targeting users with AveMaria and AgentTesla malware.
ASEC said the AveMaria samples in the campaign delayed execution with timeout.exe, used winSAT.exe and a winmm.dll-based UAC escalation method, and injected a malicious payload into RegAsm.exe.
ASEC reported an active campaign distributing malware disguised with an icon resembling AhnLab V3 Lite, primarily via phishing email attachments. The campaign delivered AveMaria RAT and AgentTesla and used .NET packing to evade detection.
Morphisec described AVE_MARIA as a relatively new malware family that was first documented toward the end of 2018.
Morphisec reported that the AVE_MARIA sample used a PkgMgr-to-DISM DLL hijacking technique for UAC bypass and communicated with 194.5.98[.]139, an IP previously identified as Orcus RAT infrastructure.
Morphisec Labs reported a phishing campaign delivering AVE_MARIA through a multi-stage, fileless infection chain using a malicious VBScript, in-memory Revenge RAT reconnaissance, and a downloader that hollowed RegAsm.exe before launching the payload.
Morphisec said one downloader component and command-and-control metadata in the AVE_MARIA campaign matched those used in Orcus RAT attacks observed the previous month, leading it to assess the same threat actor was responsible.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Cybersecurity researchers have identified a surge in malware campaigns leveraging the ClickFix social engineering technique to deploy the Amatera Stealer and NetSupport RAT. These campaigns trick users into executing malicious commands through the Windows Run dialog, often under the guise of completing a reCAPTCHA verification on fraudulent phishing pages. The infection chain typically involves the use of `mshta.exe` to launch a PowerShell script, which downloads a .NET payload from a file hosting service. The Amatera Stealer DLL, packed with PureCrypter, is injected into the `MSBuild.exe` process, enabling the malware to harvest sensitive data from crypto-wallets, browsers, messaging apps, FTP clients, and email services. Advanced evasion techniques, such as WoW64 SysCalls and in-memory AMSI patching, are employed to bypass endpoint detection and response (EDR) and antivirus solutions. The Amatera Stealer, considered an evolution of the ACR Stealer, is available as a malware-as-a-service (MaaS) offering, with subscription plans ranging from $199 to $1,499. The campaigns also deploy NetSupport RAT for remote access and further exploitation. Notably, the PowerShell scripts used by Amatera check for the presence of valuable files or domain membership before proceeding, indicating a targeted approach. These findings highlight the increasing sophistication of social engineering and malware delivery tactics, as well as the growing threat posed by MaaS platforms to organizations and individuals alike.
Jul 12, 2026
Threat actors distributed **Orcus RAT** and **RevengeRAT** through phishing emails masquerading as official complaints, using delivery methods that shifted from SendGrid-linked downloads to ZIP archives containing malicious batch files and script-based payloads. Reporting tied the activity to organizations worldwide, including government, financial services, IT services, and consulting sectors, and linked both malware families to the same client identifier, `CORREOS`, suggesting shared campaign infrastructure or operator overlap. Technical analysis showed heavily obfuscated infection chains built around VBS, batch, and PowerShell components, with payloads hidden in byte arrays, registry data, or protected loaders and then injected in memory using **RunPE/process hollowing** into legitimate processes such as `InstallUtil.exe`. Researchers also observed persistence through Startup shortcuts and recurring batch execution, along with command-and-control concealment using **DDNS** and Portmap services; one analyzed RevengeRAT sample communicated with `h0pe1759.ddns.net` and retained common remote-access features including screenshot capture, system profiling, and antivirus enumeration.
Aug 15, 2026