Loading story…
Researchers reported that malicious email attachments disguised as JavaScript files were being used to deliver a broad set of remote access Trojans and stealers through heavily obfuscated loader chains. HP Wolf Security identified the activity as RATDispenser, a stealthy JavaScript loader that decodes itself, launches cmd.exe, writes a VBScript file into %TEMP%, and then either drops or downloads a second-stage payload. Analysis of 155 samples found that 94% acted as droppers rather than network downloaders, with STRRAT and WSHRAT making up 81% of observed payloads; other delivered malware included Formbook, Remcos, AdWind, Panda Stealer, GuLoader, and Ratty. The campaign’s low average detection rate and layered obfuscation indicated an effective distribution mechanism for commodity malware.
Separate analysis of a phishing campaign targeting European organizations showed a similar JavaScript-to-VBS infection pattern delivering H-Worm/Houdini after emails impersonating entities such as UNWTO and IATA. Lab52 attributed that operation to LazyScripter and found that the attackers’ obfuscated scripts had themselves been tampered with by the online service hackfree.org, which injected an additional njRAT downloader, creating a double-compromise scenario. Researchers linked the primary campaign to infrastructure including stub.ignorelist.com and securessl.fit, while the injected secondary activity used a PowerShell downloader that contacted 185.81.157.186 to retrieve content from /NDA/199.png, underscoring how obfuscated JavaScript loaders were being reused to distribute multiple RAT families through phishing.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The domain securessl.fit, used in the phishing operation and linked from the fake job-offer PDF, was registered on July 17, 2021. It resolved to 192.64.119.125 and redirected through a DuckDNS domain.
In July 2021, a phishing campaign attributed to the emerging APT group LazyScripter targeted important European entities using lures impersonating organizations including UNWTO and IATA. The emails delivered compressed archives containing a benign PDF and obfuscated JavaScript files.
HP reported that RATDispenser, an evasive JavaScript loader spread through malicious email attachments, was used during 2021 to deliver eight malware families including STRRAT, WSHRAT/Houdini, AdWind, Formbook, Remcos, Panda Stealer, GuLoader, and Ratty. STRRAT and WSHRAT accounted for 81% of observed payloads.
Using a YARA rule named js_RATDispenser, researchers conducted a three-month retrohunt and identified 155 RATDispenser samples across three variants. Their analysis found 94% of the samples were droppers rather than network downloaders.
Researchers tested the online obfuscation service hackfree.org and found it injected its own malware into every obfuscated script it produced. In the analyzed LazyScripter samples, this added a second compromise path via an njRAT downloader distinct from the H-Worm/Houdini payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
malpedia.caad.fkie.fraunhofer.de
Open sourcelab52.io
Open sourcethreatresearch.ext.hp.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Threat actors distributed **Orcus RAT** and **RevengeRAT** through phishing emails masquerading as official complaints, using delivery methods that shifted from SendGrid-linked downloads to ZIP archives containing malicious batch files and script-based payloads. Reporting tied the activity to organizations worldwide, including government, financial services, IT services, and consulting sectors, and linked both malware families to the same client identifier, `CORREOS`, suggesting shared campaign infrastructure or operator overlap. Technical analysis showed heavily obfuscated infection chains built around VBS, batch, and PowerShell components, with payloads hidden in byte arrays, registry data, or protected loaders and then injected in memory using **RunPE/process hollowing** into legitimate processes such as `InstallUtil.exe`. Researchers also observed persistence through Startup shortcuts and recurring batch execution, along with command-and-control concealment using **DDNS** and Portmap services; one analyzed RevengeRAT sample communicated with `h0pe1759.ddns.net` and retained common remote-access features including screenshot capture, system profiling, and antivirus enumeration.
Aug 15, 2026
Researchers detailed a phishing campaign that used an **SVG attachment** to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows `search-ms` handler with a **WebDAV** path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with **Pyarmor 9**, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted **RC4-protected shellcode**, allocated executable memory, and launched a multi-stage sequence that included a **laZzzy-generated injector** targeting `notepad.exe`, more shellcode, and final **.NET malware** delivering **DcRat, AsyncRAT, XWorm RAT, and PureHVNC**. The tradecraft closely matches activity previously attributed to **DDGroup**, a long-running cybercrime actor tied to phishing campaigns that weaponize `search-ms` and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including **XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader**, along with dynamic DNS infrastructure, open-source tooling such as **Freeze.rs** and **dufs**, and repeated process injection into `notepad.exe`. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to **URLhaus** to speed blocking.
Aug 15, 2026