Loading story…
Proofpoint identified a newly observed modular remote access Trojan, Parasite HTTP, being marketed on underground forums and deployed in a limited email campaign against organizations in the information technology, healthcare, and retail sectors. The attack used resume-themed Microsoft Word attachments containing malicious macros that downloaded the malware, giving operators remote access to infected systems.
The malware stood out for a broad set of anti-analysis and stealth features more commonly associated with higher-end threats, including sandbox detection, anti-debugging, anti-emulation, string obfuscation, hook evasion, and plugin-based modularity. Proofpoint said Parasite HTTP also remapped NTDLL from KnownDlls32 to bypass userland hooks and incorporated publicly available anti-sandbox code, indicating that sophisticated evasion techniques were spreading into commodity malware sold and used more broadly.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On July 16, 2018, Proofpoint observed a small email campaign delivering Parasite HTTP via resume-themed Microsoft Word attachments with malicious macros. The campaign primarily targeted organizations in the information technology, healthcare, and retail sectors using HR-related distribution lists.
Proofpoint disclosed technical details on Parasite HTTP, including its anti-sandboxing, anti-debugging, string obfuscation, API unhooking, and NTDLL remapping techniques, and shared related indicators such as hashes, delivery URL, command-and-control domains, and an IDS signature.
Proofpoint reported that a newly observed modular Windows remote access Trojan named Parasite HTTP was being advertised for sale on underground markets, with features including plugin support, encrypted communications, persistence, and anti-analysis capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have used **Parallax RAT**, a low-cost remote access Trojan sold on criminal forums, in phishing and spam campaigns that compromise Windows systems and increasingly target cryptocurrency organizations. Delivery has relied on malicious Microsoft Word attachments, embedded macros, and exploits such as `CVE-2017-11882`, giving attackers full remote access for credential theft, file theft, clipboard monitoring, keylogging, command execution, and broader system control. Researchers reported that the malware has been active since late 2019 and has remained a common payload because of its low price and ease of deployment. Technical analyses show Parallax RAT using multi-stage loaders, process hollowing, and persistence mechanisms including the Windows Startup folder and scheduled tasks. Recent samples decrypted payloads with **RC4**, injected into legitimate processes including `pipanel.exe`, `Notepad.exe`, `mstsc.exe`, and `cmd.exe`, and fetched additional components from services such as **Pastebin** and **Imgur**, while some command-and-control infrastructure used **DuckDNS**. Investigators also observed attacker interaction through Windows Notepad, victim instructions pointing to a Telegram channel, and cleanup scripts designed to delete payloads and remove traces after execution.
Aug 14, 2026
Multiple active malware campaigns are using **social engineering** and **trojanized content** to compromise Windows systems, with lures ranging from pirated software downloads to business and shipping documents. AhnLab reported a “proxyjacking” operation attributed to **Larva-25012** that distributes fake installers (notably a trojanized *Notepad++* package) via cracked-software sites; the `Setup.zip` bundle includes a legitimate `Setup.exe` plus a malicious sideloaded DLL (`TextShaping.dll`) that decrypts and installs **DPLoader** for persistent command retrieval and follow-on payload delivery. The malware also tampers with defenses by changing Microsoft Defender settings (e.g., exclusions, reduced notifications, and blocking sample submission) to reduce detection while monetizing victims’ bandwidth through installed **proxyware**. Separately, FortiGuard Labs described a Russia-focused, multi-stage intrusion chain that abuses trusted services (**GitHub** and **Dropbox**) for payload hosting and weaponizes **Defendnot** (a Windows Security Center trust-model research tool) to disable **Microsoft Defender** before deploying a ransomware payload. Fortinet also documented phishing campaigns using weaponized shipping-themed Word documents to deliver **Remcos RAT**, including fileless execution behavior and exploitation of `CVE-2017-11882` (Microsoft Equation Editor) via remotely fetched templates. These campaigns reinforce the operational risk from user-driven execution paths (pirated installers and document lures), “living off the land” techniques, and defense evasion through both policy tampering and security tooling abuse.
Jun 29, 2026
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026