Loading story…
Two recruitment-themed malware campaigns use decoy job documents to deliver multi-stage, memory-resident implants after a single click. One campaign distributes a ZIP archive containing a renamed WinWord.exe that DLL-side-loads a malicious component to deploy PureRAT/ResolverRAT; researchers assess its infrastructure and tradecraft as overlapping with the Vietnam-nexus PXA Stealer criminal cluster. The other disguises an LNK shortcut as a PDF, invokes mshta.exe, and retrieves a custom native implant that decrypts and reflectively maps its DLL payload in memory. The second operation has not been attributed to a known threat actor.
Both chains reduce Windows telemetry and analysis visibility through sandbox-evasion measures and Task Scheduler COM-based persistence rather than schtasks.exe, while providing attackers remote-access capability. The PureRAT campaign adds scheduled tasks, WMI event subscriptions, COM hijacking, and mirrored staging directories that can restore removed artifacts. The activity follows prior reporting on job-offer social engineering used to deploy Pure-family malware, including PureHVNC and PureRAT-linked tooling, and shows the continued use of this ecosystem alongside heavily obfuscated loaders and persistence mechanisms.
Pull IOCs and campaign context straight into your stack.
13 events from the most recent confirmed update back to the earliest known activity.
The financially motivated REF1695 operation was active from at least late 2023, distributing trojanized software installers, including ISO images, to compromise Windows hosts for cryptomining and CPA content-locker fraud.
The unattributed native implant performed sandbox checks, assigned victims persistent cryptographic identities, and checked in to a centralized operator platform. It persisted through a COM-registered task disguised as Windows System Update Service and supported reconnaissance, keylogging, screen and microphone capture, payload deployment, and self-removal.
A separate recruitment-themed operation used Job Interview.zip containing a PDF-disguised LNK that launched mshta.exe to retrieve HTA content. The HTA downloaded a fake Lenovo Vantage Service executable and encrypted payload, which were decrypted and manually mapped into memory.
The PureRAT job-offer campaign was assessed with high confidence to overlap a Vietnam-nexus, financially motivated cluster previously associated with PXA Stealer. The assessment cited shared C2 infrastructure, loader artifacts, encoding methods, DLL side-loading, and Apex-themed recruitment branding.
The PureRAT campaign registered four COM-based scheduled tasks, created the FontCacheWorker permanent WMI subscription, and hijacked the MMDeviceEnumerator CLSID to load AudioSes.dll. Its mirrored staging directories could restore deleted artifacts, while in-memory patches targeted AMSI and ETW visibility functions.
A recruitment-themed campaign used Apex Job Description.zip to expose a renamed WinWord.exe, which DLL-side-loaded a malicious AppVIsvSubsystems64.dll. The chain ran a concealed Python loader, displayed a decoy job document, and loaded PureRAT/ResolverRAT entirely in memory.
On the eighth day of the ClickFix intrusion, the actor delivered a Sliver implant that communicated with a Fastly-hosted C2 URL. Sliver executed a PowerShell credential-theft script that prompted for the victim's password and saved it to a ProgramData text file.
On the second day of the intrusion, the actor deployed a newer PureHVNC payload with campaign ID amazon3, packed with Inno Setup and a Rust DLL loader. The loader executed through regsvr32, used anti-analysis checks and an AMSI bypass, and persisted through a scheduled task disguised as Google Updater.
A ClickFix campaign used fake job offers to trick victims into executing a clipboard-copied PowerShell command. The command launched malicious JavaScript that established Startup-folder LNK persistence and delivered PureHVNC configured with campaign ID 2a.
Another REF1695 campaign deployed PureRAT, PureMiner, and a custom XMRig loader while disabling sleep and hibernation to extend mining time. A Umnr_ variant deployed SilentCryptoMiner, whose watchdog restored removed loader and persistence artifacts and injected mining components into explorer.exe.
A PureRAT C2 task instructed infected hosts to download the custom XMRig loader MnrsInstllr_240126.exe from GitHub raw content. The loader retrieved encrypted mining configuration, deployed a renamed XMRig binary and WinRing0x64.sys, and terminated mining when analysis tools were detected.
A separate REF1695 campaign delivered PureRAT v3.0.1 through multistage loaders, dropped a malicious svchost.exe payload, and created the high-privilege ONLOGON task SVCConfig. The PureRAT configuration used multiple C2 domains and the Aesthetics135 mutex and communications key.
A REF1695 campaign used a ReadMe.txt lure to persuade victims to bypass SmartScreen, added Microsoft Defender exclusions, and installed the previously undocumented CNB Bot implant. CNB Bot persisted as a high-privilege scheduled task and supported signed C2 tasking, downloads, updates, and removal.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 81 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyderes.com
Open sourceelastic.co
Open sourceresearch.checkpoint.com
Open sourcenetresec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Multiple reports detail **social-engineering-driven malware delivery** that results in **remote access trojans (RATs)** and credential theft. Infoblox described observing an affiliate push-notification ad network after exploiting misconfigured DNS delegations (“**Sitting Ducks**”/lame name server delegation) to take over abandoned threat-actor domains, allowing collection of **~57M logs** over two weeks and visibility into widespread **scams and brand impersonation** delivered via push ads. Nextron Systems separately reported recurring **malvertising** chains where “free converter” tools (e.g., document/image converters) downloaded from ads on legitimate sites function as advertised while covertly installing **persistent RATs**, with common artifacts such as Windows **Mark-of-the-Web** (`ZoneId=3`) indicating internet origin. Other activity in the set reflects different initial-access lures but the same general outcome—RAT-style access and data theft. Fortinet analyzed a **phishing** campaign using a fake Vietnam shipping document: a Word attachment leads to an RTF stage that exploits an RTF-related vulnerability, then uses **VBScript/PowerShell** to load a **fileless .NET module**, ultimately downloading and injecting a **Remcos** variant (including process hollowing) to provide full remote control. Separately, reporting on North Korea’s **“Contagious Interview”** campaign described fake recruiter outreach (e.g., via LinkedIn) that tricks developers into opening malicious code repositories; execution can be triggered via a hidden **VS Code `tasks` configuration**, server-side logic hooks, or a malicious npm dependency to steal credentials/crypto wallets and establish persistence—this is thematically similar (social engineering leading to remote access) but is a distinct operation from the malvertising/push-ad and Remcos phishing activity.
Jun 29, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026