OCX#HARVESTER Phishing Campaign Uses More_eggs and LOLBins to Target Crypto Firms

Securonix Threat Labs reported that the OCX#HARVESTER campaign used phishing emails carrying ZIP archives with disguised .lnk files to compromise victims, with activity observed primarily between late 2022 and early 2023. The operation appears tied to the More_eggs/Golden Chickens malware ecosystem and likely focused on organizations and individuals linked to the financial sector, particularly cryptocurrency-related entities. After execution, the infection chain launched obfuscated JavaScript loaders and abused multiple Windows living-off-the-land binaries, including ie4uinit.exe, msxsl.exe, wmic.exe, regsvr32.exe, curl.exe, and typeperf.exe, to stage payloads, establish persistence, and communicate with command-and-control infrastructure.

Later stages deployed several OCX#HARVESTER binaries, including a screenshot-capture component, additional obfuscated implants, and what researchers assessed was likely a Cobalt Strike beacon. Operators also retrieved SharpChrome to steal Chrome cookies and credentials, expanding the campaign from initial access to credential theft and post-compromise surveillance. The use of msxsl.exe, a known LOLBin documented by the LOLBAS project, underscores the campaign's reliance on legitimate Microsoft-signed utilities to blend malicious activity into normal system operations, while shifting command-and-control infrastructure suggests the toolkit remains actively maintained and adapted to evade detection.