Loading story…
Researchers reported that the SVCReady malware loader is being distributed through phishing campaigns that weaponize Microsoft Word documents and use an uncommon execution chain. Malicious VBA macros do not fetch a payload with typical tools such as PowerShell or MSHTA; instead, they extract shellcode concealed in the document’s custom properties, execute it directly in memory, and then drop a DLL payload into the victim’s %TEMP% directory.
Analysis from HP Wolf Security and follow-on reporting indicates SVCReady had been active since April 2022 and was updated multiple times in May, pointing to ongoing development. The malware includes information theft, persistence, anti-analysis features, and encrypted command-and-control communications, and it further evades detection by abusing a renamed copy of rundll32.exe to launch the dropped payload.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
HP observed several updates to SVCReady in May 2022, indicating the loader was under active development and still at an early stage.
HP reported that the SVCReady malware loader had been deployed in phishing attacks since April 2022, using malicious Word document attachments to infect targets.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SquirrelWaffle was used in phishing campaigns that delivered malicious ZIP archives containing Word or Excel documents, then relied on VBA or XLM macros to launch a multi-stage infection chain. In documented cases, the documents dropped a VBS script or invoked PowerShell to download DLL payloads, which were executed with **`rundll32`** or **`regsvr32`** and ultimately fetched follow-on malware including **Cobalt Strike** and, in some campaigns, **Qakbot**. Traffic analysis of one observed intrusion showed the loader arriving from an email-delivered ZIP file, infecting a Windows host, and then transitioning into Cobalt Strike activity on the network. Reverse-engineering reports show the SquirrelWaffle DLL loader used a custom packer and several anti-analysis measures, including manual rebasing, junk API padding, in-memory decryption, and remapping of a second-stage PE into the current process. The main loader decoded hardcoded C2 URLs, collected host data such as computer name, username, domain, local IP address, and **`APPDATA`** path, and sent that information in HTTP POST requests before acting on server responses. Depending on the returned tasking, it could drop and register executables, run payloads from **`TEMP`**, execute shellcode through a threadpool wait callback, or write and launch an operator-specified executable path.
Aug 15, 2026
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Security researchers reported a widespread phishing-driven malware delivery operation using a custom loader dubbed **PhantomVAI**, which masquerades as legitimate software and uses **process hollowing** (RunPE) to inject payloads into legitimate Windows processes. The loader has been observed targeting users globally via malicious email attachments and links, then downloading and executing remote payloads in a way intended to blend into normal system activity and complicate detection. Analysis attributed to *Intrinsec* links PhantomVAI’s core execution to a legacy, open-sourced RunPE utility (“**Mandark**”) originally shared on hacking forums (including code fingerprints such as `Hackforums.gigajew`). Researchers also noted **Windows Task Scheduler masquerading** (e.g., appearing as `Microsoft.Win32.TaskScheduler.dll` based on a legitimate GitHub project) and shared code traits (e.g., a “VAI” method and Portuguese strings). Multiple vendors reportedly tracked the same loader under different names (e.g., **VMDetectLoader** and **Caminho Loader**), and it has been associated with delivering commodity malware families including **Remcos**, **XWorm**, **AsyncRAT**, **DarkCloud**, and **SmokeLoader**.
Jun 29, 2026