Loading story…
Malspam campaigns used Java Network Launch Protocol attachments (.jnlp) to bypass some email defenses and launch malware from victim systems with Java installed. In one case, a file posing as "Microsoft Secure Document Reader" directed Java to download delivery.jar from secured-doc-read[.]net, which then retrieved a second-stage payload from sec-doc-v[.]com/images/dsc0386234.jpg, saved it as C:\ProgramData\videodrv.exe, and attempted execution. Analysts noted that .jnlp files are plain XML rather than embedded executables, a trait that can help them slip past mail filters despite ultimately triggering code download and execution.
A separate campaign impersonated DHL with an invoice.jnlp attachment that downloaded a Java archive from invoicesecure[.]net, showed a fake error message as a decoy, and dropped C:\ProgramData\drvr32.exe, identified as Buer Loader. VIPRE reported the malware established persistence through the Startup folder, performed anti-analysis checks, gathered host details, and communicated with verstudiosan[.]com over HTTP GET and POST. The phishing operation also used forged headers, SPF softfail, and brand impersonation to increase credibility, underscoring that .jnlp attachments remain a viable delivery mechanism for staged malware infections.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
VIPRE noted that the Buer Loader malware family had first been observed in 2019 and is commonly distributed through malicious spam campaigns.
VIPRE analyzed a phishing campaign impersonating DHL that used forged email headers, DHL branding, and a .jnlp attachment named invoice.jnlp. The attachment downloaded a JAR from invoicesecure[.]net, showed a fake error, then fetched and executed drvr32.exe, which was identified as Buer Loader.
SANS analyzed an email-borne attack that used a malicious .jnlp attachment masquerading as a Microsoft secure document reader to download and run a JAR, which then fetched a PE payload. The technique relied on JNLP files being plain XML text files that may evade some mail filters while still launching Java code on systems with Java installed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple active malware delivery campaigns are using social engineering and trusted-looking artifacts to install **remote access trojans (RATs)**. One campaign impersonates the popular Chinese antivirus *Huorong Security* via a typosquatted domain `huoronga[.]com`, routing downloads through an intermediary domain and serving a trojanized NSIS installer from Cloudflare R2; the payload is **ValleyRAT**, described as built on the **Winos4.0** framework and attributed to the Chinese-speaking **Silver Fox** threat group. The infection chain is designed to look legitimate end-to-end (convincing website, normal installer UX) while deploying a full-featured backdoor with stealth and injection capabilities. Separately, email-borne campaigns are abusing attachments and “benign” file types to smuggle malware. Fortinet-reported activity uses phishing lures (e.g., payment or bank-document themes) with Excel attachments exploiting `CVE-2018-0802` to launch scripts that download a JPEG containing embedded **XWorm 7.2**, then uses **process hollowing** (e.g., into `Msbuild.exe`) and connects to a C2 at `berlin101.com` over port `6000` with AES encryption. SANS ISC also documented a similar “malicious JPEG” technique observed in the wild, where a large, heavily obfuscated JScript attachment (delivered in a GZIP wrapper) attempts persistence by copying itself to the Startup folder and participates in a chain that ultimately leverages payloads embedded in JPEGs; the message spoofing failed DMARC/SPF checks, which would likely lead to quarantine in many environments.
Jun 29, 2026
Threat researchers reported that attackers increasingly used malicious Microsoft Excel add-in files with the `.xll` extension as an initial access vector, exploiting Excel's `xlAutoOpen` behavior to run code with a single user action. HP Wolf Security said the technique was being used to deliver malware including **Dridex**, **Agent Tesla**, **Raccoon Stealer**, and **Formbook**, and noted that some samples were built with the legitimate **Excel-DNA** framework while others were custom downloaders that decrypted embedded configuration data, resolved APIs dynamically, fetched payloads, and executed them. Researchers also observed underground promotion of XLL dropper builders, indicating the method was becoming commoditized. Fortinet and SANS documented active spam operations using the format in the wild. One campaign used DHL and Amazon-themed lures to distribute a signed malicious XLL that downloaded `csrsc.exe` from `dmequest[.]com`, saved it as `%PUBLIC%\srtherhaeth[.]eXe`, and installed a Rust-based **Buer Loader** variant that communicated with `shipmentofficedepot[.]com`; the file was signed with a certificate assigned to **HORUM**, likely to reduce detection. Separately, SANS observed a **Hancitor** malspam wave using DocuSign-themed emails and Google `feedproxy` links that redirected victims through compromised sites to an XLL payload, which then retrieved an HTA file and a Hancitor executable from `srand04rf[.]ru`, followed by activity linked to **Cobalt Strike** and **Ficker Stealer**. Defenders were advised to block inbound XLL attachments, restrict add-ins to trusted signed files, or disable proprietary Excel add-ins where possible.
Aug 15, 2026
Researchers reported active phishing operations using business-document lures and fake "secure mail" messages to infect Windows users with **VIP Keylogger** and related infostealers. Splunk said attackers sent payment notices, procurement orders, and logistics updates carrying heavily obfuscated `.vbs`, `.js`, or `.bat` loaders that launched PowerShell stagers, hid data in environment variables, and used steganography in PNG files to rebuild the final payload. K7 Labs also tracked a malware-as-a-service **VIP_Keylogger** campaign, while Splunk said the malware injects into `aspnet_compiler.exe` and steals keystrokes, screenshots, browser and Outlook credentials, clipboard contents, and cryptocurrency wallet addresses before exfiltrating data to attacker infrastructure, including Telegram. AhnLab separately detailed a South Korea-focused campaign impersonating a major credit card company with malicious LNK files that executed PowerShell and `mshta`, fetched an HTA with obfuscated VBScript, and displayed decoy documents to reduce suspicion. The malware changed behavior depending on whether Windows Defender was enabled: one path delivered AES-encrypted archives with backdoor, keylogging, clipboard theft, and information-stealing components, while the other used `rundll32` to load a downloader that avoided VBox and VMware and then pulled additional payloads from Google Drive to steal browser, email, cookie, clipboard, and cryptocurrency wallet data. Defenders were urged to scrutinize email attachments and file types, monitor suspicious registry and PowerShell activity, and watch for script-launched processes and Telegram-related DNS traffic.
Jun 29, 2026