Loading story…
A phishing campaign masquerades as project quotation requests and asks recipients to download a compressed attachment to review project-budget details. The archive contains an obfuscated VBScript that constructs a PowerShell command to retrieve a staged payload from Google Drive and save it as %APPDATA%\Maleic.For.
The malware uses an in-memory PowerShell stage that abuses the ShellWindows COM object and Explorer’s ShellExecute path to bypass UAC. A loader then XOR-decrypts and executes a further payload in memory, ultimately downloading Remcos RAT and injecting it into MicrosoftEdgeUpdate.exe. Compromised hosts can be remotely controlled for command execution, keylogging, screen capture, file operations, and collection of system and user data.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A phishing campaign masquerading as project quotation and budget-discussion requests lured recipients to download compressed attachments containing an obfuscated VBScript. The infection chain downloaded staged payloads from Google Drive, bypassed UAC, and ultimately injected Remcos RAT into MicrosoftEdgeUpdate.exe for remote access and data collection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign impersonated employees of a South Korean company and sent project-material purchase-request emails carrying malicious XLS attachments. The spreadsheet displayed a credible decoy purchase form but exploited the Microsoft Office OLE2Link remote-code-execution flaw, `CVE-2017-0199`, to retrieve a malicious HTA payload. The HTA invoked WMI `Win32_Process.Create` to launch obfuscated PowerShell, which downloaded a steganographic PNG containing an in-memory .NET loader. The loader deployed **Remcos RAT**, giving operators remote command execution and the ability to collect system and user data, log keystrokes, capture screens, manipulate files, and exfiltrate data through command-and-control infrastructure.
Sep 30, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
A phishing campaign is using emails disguised as payment or money transfer confirmations to trick recipients into opening a malicious **XLS** attachment. The messages impersonate employees of a specific company in Korea and present the spreadsheet as a legitimate payment slip, using a financial transaction lure to increase the likelihood that targets will open the file. When opened, the attachment exploits **`CVE-2017-0199`** in Microsoft Office to retrieve a remote **HTA** payload. The HTA then uses **WMI `Win32_Process.Create()`** to launch an obfuscated PowerShell script that downloads a steganographic **PNG** file, extracts and decrypts an in-memory **.NET** loader from embedded Base64 data, and ultimately installs **Remcos RAT**. The malware gives attackers remote access, including command execution, keylogging, screen capture, file manipulation, and data exfiltration to command-and-control infrastructure.
Jul 13, 2026