Loading story…
A malicious email campaign delivered the MoDi RAT through a multi-stage, largely fileless infection chain that relied on VBScript, PowerShell, Registry-stored payloads, and process injection. The attack began with an email attachment that triggered HTTP 302 redirects to a OneDrive-hosted ZIP archive, then established persistence with a Scheduled Task and stored payload components in the Windows Registry rather than on disk. Sophos reported that some artifacts contained French-language strings and that some of the targeted organizations were French firms.
The intrusion used an unusual evasion technique in which a VBS script opened PowerShell and pasted commands into the console through the clipboard and SendKeys, reducing the visibility of command-line activity to security tools. PowerShell then extracted and reflectively loaded a .NET decoder from the Registry, unpacked an injector and the final payload, and injected the RAT into msbuild.exe without writing the malware to disk. Sophos said AMSI telemetry helped detect and block the attack, while noting that AMSI-based protections are available only on newer Windows platforms including Windows 10 and Windows Server 2016/2019.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Sophos published indicators of compromise related to the investigation on the SophosLabs GitHub, providing technical details tied to the attack chain.
Sophos said it proactively blocked the attack based on its fileless delivery technique and then enhanced existing detections to improve resilience against similar attacks. The company said its products detect components as AMSI/Reflect-D, Troj/VBSInj-D, and AMSI/ModiRat-A.
SophosLabs researchers Fraser Howard and Andrew O’Donnell analyzed an attack chain seen in telemetry that began with a malicious email attachment and ultimately deployed the MoDi RAT remote access Trojan using fileless techniques.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a malware campaign using obfuscated **VBS** and **PowerShell** stages hosted across multiple DuckDNS domains to infect 64-bit Windows systems with a remote access trojan. The chain decrypts an **AES-256**-protected PowerShell stage, extracts a 64-bit payload, and uses a .NET helper to hollow `AppLaunch.exe` for stealthy execution. The malware then establishes persistence through the Windows Startup folder and attempts to weaken defenses by adding Microsoft Defender exclusions. The RAT communicates with suspected command-and-control infrastructure over port `4577` and is designed for credential theft and surveillance. Reported capabilities include stealing browser credentials and cookies, keylogging, clipboard capture, remote control, and local storage of stolen data, raising the risk of account takeover and broader compromise of enterprise sessions and sensitive information. The reporting includes hashes, filenames, domains, an IP address, and filesystem paths as indicators of compromise, with defenders urged to block the infrastructure, hunt for suspicious PowerShell activity, and isolate affected hosts.
Aug 10, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026