DonutLoader

The campaign appears to be spreading through malvertising, where attackers pay to place malicious links in search engine ads and sponsored results.

Threat actors may have also used SEO poisoning to further boost the site’s visibility in organic search results.

Many of the Keitaro IP addresses we saw in the AS214351 network host and distribute malware.

Stage 1: Email Delivery Victim receives spearphishing email with .JS attachment Lure themes: "Bill of Lading", "Vessel Particulars", "Urgent Inquiry For Quotation"

62[.]60[.]226[.]248 hosted the DonutLoader malware payload... a memory‑only loader that turns PE/.NET/DLL/script into shellcode and injects them into other processes.

MITRE ATT&CK Mapping Tactic Technique ID Application Execution PowerShell T1059.001 Invoke-WebRequest + Add-Type inline C#

Stage 2: JavaScript Execution via WSH Double-click triggers WScript.exe (Windows Script Host) Script begins deobfuscation through 4-layer chain

"Velvet Tempest ... observed using a ClickFix lure, followed by hands-on-keyboard activity"

"...relies on affiliates, social engineering, fake cracked software, and fake CAPTCHA “ClickFix” lures." / "ClickFix pages trick users into pasting malicious PowerShell commands."

Once the MSI executes, it drops three files into the Windows Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and a malicious DLL named avk.dll.

After unpacking the core archives, the malware moves into an advanced code injection stage.

MITRE ATT&CK Mapping Tactic Technique ID Application Execution Reflective Code Loading T1620 Donut decrypts + loads PE in-memory Defense Evasion Obfuscated Files: Embedded Payloads T1027.009 Chaskey-16 CTR encrypted Donut payloads Defense Evasion Masquerading: Legitimate Name T1036.005 Process named nsvchost.exe Defense Evasion Subvert Trust Controls T1553 Inline C# avoids pre-compiled AV detection Privilege Escalation Token Manipulation T1134.001 SeDebugPrivilege via AdjustTokenPrivileges Discovery Process Discovery T1057 CreateToolhelp32Snapshot for svchost.exe Lateral Movement Process Injection: DLL Injection T1055.001 VirtualAllocEx + WriteProcessMemory into svchost.exe

Once the MSI executes, it drops three files into the Windows Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and a malicious DLL named avk.dll.

On Windows systems, the hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" that employs several obfuscation techniques to evade detection...

...extracts DonutLoader, a shellcode loader, from a PNG image present within the binary to load a full-featured trojan and a beacon associated with AdaptixC2...

The dropped PE is not AgentTesla itself but a DonutLoader shellcode packer. DonutLoader unpacks and executes the AgentTesla binary entirely in memory, leaving no additional artifacts on disk beyond the initial dropper.

extracts DonutLoader, a shellcode loader, from a PNG image present within the binary

MITRE ATT&CK Mapping Tactic Technique ID Application Execution Reflective Code Loading T1620 Donut decrypts + loads PE in-memory Defense Evasion Obfuscated Files: Embedded Payloads T1027.009 Chaskey-16 CTR encrypted Donut payloads

Attackers set up a convincing lookalike website to distribute a dangerous installer... The fake site, hosted at claude-pro[.]com, closely mirrors the look and feel of the real Claude website, using similar fonts and color schemes.

After unpacking the core archives, the malware moves into an advanced code injection stage.

MITRE ATT&CK Mapping Tactic Technique ID Application Execution Reflective Code Loading T1620 Donut decrypts + loads PE in-memory Defense Evasion Obfuscated Files: Embedded Payloads T1027.009 Chaskey-16 CTR encrypted Donut payloads Defense Evasion Masquerading: Legitimate Name T1036.005 Process named nsvchost.exe Defense Evasion Subvert Trust Controls T1553 Inline C# avoids pre-compiled AV detection Privilege Escalation Token Manipulation T1134.001 SeDebugPrivilege via AdjustTokenPrivileges Discovery Process Discovery T1057 CreateToolhelp32Snapshot for svchost.exe Lateral Movement Process Injection: DLL Injection T1055.001 VirtualAllocEx + WriteProcessMemory into svchost.exe

The program decodes these items at runtime via a simple single-byte mathematical conversion.

After dropping the PE payload to C:\Users\Public\Libraries\ , the dropper does not execute it directly. Instead, it invokes Scriptrunner.exe -appvscript <payload_path> , abusing the legitimate Microsoft App-V Scriptrunner binary as a Living-off-the-Land Binary (LOLBin).

The final payload, CASTLESTEALER, is then delivered entirely in memory using an open-source shellcode generator called DonutLoader, leaving almost no trace on disk.

The hack of the Telnyx Python SDK resulted in the deployment of an executable named "msbuild.exe" ... to load a full-featured trojan and a beacon associated with AdaptixC2, an open-source command-and-control (C2) framework.

MITRE ATT&CK Mapping Tactic Technique ID Application Execution Reflective Code Loading T1620 Donut decrypts + loads PE in-memory Defense Evasion Obfuscated Files: Embedded Payloads T1027.009 Chaskey-16 CTR encrypted Donut payloads Defense Evasion Masquerading: Legitimate Name T1036.005 Process named nsvchost.exe Defense Evasion Subvert Trust Controls T1553 Inline C# avoids pre-compiled AV detection Privilege Escalation Token Manipulation T1134.001 SeDebugPrivilege via AdjustTokenPrivileges Discovery Process Discovery T1057 CreateToolhelp32Snapshot for svchost.exe Lateral Movement Process Injection: DLL Injection T1055.001 VirtualAllocEx + WriteProcessMemory into svchost.exe Collection Screen Capture T1113 GDI BitBlt screenshot Credential Access Credentials from Web Browsers T1555.003 Chrome/Edge/Brave/Opera/Vivaldi credential theft Credential Access Steal Web Session Cookie T1539 Cookie file theft from Chromium browsers Credential Access Credentials in Files T1552.001 OpenVPN auth.txt, crypto wallet files Command and Control Web Protocols T1071.001 HTTP C2 for payload delivery and exfiltration

When I examined the ValleyRAT C2 traffic from the Triage sandbox execution I noticed that CapLoader as well as FlowCarp identified it as Gh0stKCP, which is a UDP-based protocol that ValleyRAT sometimes uses to transport its C2 traffic.

Command and Control Ingress Tool Transfer T1105 BitsAdmin/PowerShell downloading payloads