Loading story…
Security researchers reported a phishing campaign using a PDF attachment named "REMMITANCE INVOICE.pdf" to deliver Snake Keylogger through a multi-stage infection chain. The PDF carried an embedded Word document that appeared trustworthy, and the document then retrieved a remote template or RTF file from attacker-controlled infrastructure. That RTF contained malformed OLE content exploiting the Microsoft Equation Editor flaw CVE-2017-11882, allowing shellcode to run and download the final Windows payload, identified in reporting as vbc.exe or fresh.exe and linked to Snake Keylogger.
Analysts said the campaign relied on layered evasion, including hiding a malicious DOCX inside a PDF, hosting the exploit remotely, and decrypting shellcode in memory before execution. The final malware was described as a modular information stealer capable of credential theft, persistence, defense evasion, data collection, and exfiltration over SMTP. Researchers highlighted that the attack demonstrates the continued effectiveness of the long-patched CVE-2017-11882 vulnerability and advised defenders to analyze suspicious files with dedicated tooling rather than opening them in PDF or Office applications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported on HP Wolf Security's findings about a PDF-based malware campaign that smuggled an embedded Word document to trigger a CVE-2017-11882 exploit and install Snake Keylogger. The coverage highlighted continued abuse of the long-patched Equation Editor flaw in the wild.
HP Wolf Security reported a malware campaign using emailed PDF attachments to deliver an embedded Word document and a remote RTF exploit chain. Its analysis linked the malformed OLE objects to CVE-2017-11882 and identified the final payload fresh.exe as Snake Keylogger.
NVISO Labs published an analysis of the multilayer malicious document chain, showing that the PDF embedded a DOCX, the DOCX fetched a malformed RTF, and shellcode in an embedded OLE object downloaded a Windows executable. The analysis identified the final malware as Snake Keylogger and later tied the exploit stage to CVE-2017-11882.
Microsoft fixed CVE-2017-11882, a remote code execution vulnerability in Microsoft Equation Editor. Later reporting on the Snake Keylogger campaign identified this flaw as the exploit used in the malicious RTF stage.
In the observed campaign, attackers sent email messages with a PDF attachment named "REMMITANCE INVOICE.pdf" or "Remittance Invoice" that embedded a Word document. The DOCX used an external relationship to fetch a remote RTF file, which exploited CVE-2017-11882 and led to download of a Snake Keylogger payload identified as fresh.exe or vbc.exe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcethreatresearch.ext.hp.com
Open sourceblog.nviso.eu
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Researchers detailed ongoing Snake Keylogger activity in which attackers deliver the .NET-based infostealer through phishing emails carrying archive files, malicious executables, exploit-laden RTF documents abusing `CVE-2017-11882`, and Excel attachments with password-protected VBA macros. In one analyzed chain, a lure such as `SeptemberOrderlist.pdf.exe` decrypted intermediate .NET assemblies before launching the final payload, while another used base64-encoded PowerShell to download a Snake downloader, retrieve an RC4-encrypted DLL, and deploy the malware through process hollowing. Snake is designed to steal credentials and other sensitive data from more than 50 applications, including browsers, email and FTP clients, communication tools, wireless profiles, and Windows product information, while also capturing keystrokes, screenshots, clipboard contents, host details, geolocation, and time data. The malware can persist through scheduled tasks or Startup-folder registry changes, evade defenses by killing security tools, adding Windows Defender exclusions, and deleting itself, and exfiltrate stolen data over SMTP, FTP, or Telegram via HTTPS. Multiple researchers said Snake shares strong code and loader similarities with commodity stealers such as FormBook, Agent Tesla, Matiex, 404, Cheetah, and Phoenix, pointing to code reuse or shared tooling in the cybercrime ecosystem.
Aug 15, 2026
Researchers detailed how **Snake Keylogger**—also tracked as **404 Keylogger**—continues to spread through multi-stage infection chains that begin with phishing documents or other loaders and end in credential theft, surveillance, and data exfiltration. One analyzed campaign used a malicious Microsoft Word file with VBA macros that dropped an `.inf` file into `%TEMP%` and abused `LaunchINFSectionW` from `Advpack.dll` to execute the next stage through legitimate Windows components. That chain then used built-in tools to reconstruct and launch a disguised DLL downloader, which attempted to fetch an additional payload from a remote command-and-control endpoint. Separate technical analyses describe Snake as a long-running **malware-as-a-service** operation with modular .NET payloads, in-memory decryption, steganographic extraction of components, and execution techniques including process injection and process hollowing. The malware is designed to steal browser, email, FTP, Discord, and Wi-Fi credentials; log keystrokes; capture screenshots and clipboard data; profile infected hosts; and evade analysis through anti-debugging checks and termination of security tools. Researchers also reported persistence through registry keys, startup items, or scheduled tasks, and exfiltration over channels including **Telegram**, **SMTP**, and **FTP**, while linking the family to variants such as **Matiex**, **Cheetah**, and **Nova**.
Jul 13, 2026