Loading story…
Researchers reported an active phishing campaign targeting users in India with archive attachments disguised as GST debit notes, including files such as GST Debit Note Apr_26.com, to deliver Remcos RAT. The infection chain relies on a multi-stage, largely memory-only loader that uses embedded steganographic payloads, multiple .NET stages, in-memory DLL execution, and process hollowing to evade traditional defenses. Analysis indicates the operation may be part of a loader-as-a-service ecosystem, as related infrastructure has also been linked to payloads including Agent Tesla, RedLine Stealer, Formbook, XWorm, Dark Cloud, Phantom Stealer, MassLogger, and Snake keyloggers.
Once installed, Remcos establishes persistence through Run registry keys and Winlogon/Userinit mechanisms, performs anti-sandbox and anti-VM checks, and attempts UAC bypass via eventviewer.exe. The malware steals browser credentials and cookies, captures user activity, and can record audio and webcam feeds before storing data in logs.dat and exfiltrating it to command-and-control infrastructure including 62.102.148.212:37393. Filenames referencing NEFT, RTGS, IMPS, and GST further indicate the campaign was tailored to Indian financial and business workflows.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
JFrog connected the additional npm packages postcss-minify-selector and aes-decode-runner-pro to the same Windows RAT operation. At the time of the report, all three malicious packages were still live on the npm registry.
JFrog identified a supply-chain campaign targeting Windows developers through malicious npm packages masquerading as PostCSS tooling, centered on the typosquatted package postcss-minify-selector-parser. The infection chain used PowerShell, a ZIP payload from nvidiadriver[.]net, and a VBS bootstrapper to install a Windows RAT.
K7 assessed that the same delivery infrastructure was also used to distribute Agent Tesla, Phantom Stealer, Dark Cloud, RedLine Stealer, MassLogger variants, Formbook, XWorm, and Snake keyloggers. The infrastructure reuse and changing payloads suggested a loader-as-a-service operation.
K7 Labs identified a phishing-delivered malware campaign involving the suspicious file "GST Debit Note Apr_26.com," distributed as an archive attachment and themed around Indian financial and tax lures. Analysis showed the campaign used a multi-stage, in-memory steganographic loader to deploy Remcos RAT.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcelabs.k7computing.com
Open sourcearyaka.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used spoofed Government of India GST refund emails to target Indian businesses and taxpayers, luring recipients into opening a malicious RAR attachment that launched a multi-stage **.NET** infection chain and ultimately deployed **Remcos RAT**. Seqrite reported that the initial executable unpacked successive in-memory loaders hidden in bitmap resources and DLL stages, including **`Windows Health Optimizer Plus.dll`** and **`perfgurd.dll`**, while using reflection, **XOR-based decryption**, and architecture-aware method dispatch to evade analysis and execute the final payload. The campaign established persistence by copying the executable and launching a **PowerShell** script through a **Run** registry key, and it attempted privilege escalation via **`cmstp.exe`**. The final **Remcos RAT** payload enabled remote access, credential theft, surveillance, and delivery of additional malware. Infrastructure tied to the operation included dynamic DNS domains under **`hath.network`** and **`synology.me`**, with command-and-control activity resolving to **`185.242.4.122`** on hosting associated with **M247 Europe SRL**; researchers assessed the activity as likely financially motivated cybercrime but did not attribute it to a known threat actor.
Jul 23, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026