Loading story…
Researchers detailed a phishing campaign that used an SVG attachment to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows search-ms handler with a WebDAV path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with Pyarmor 9, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted RC4-protected shellcode, allocated executable memory, and launched a multi-stage sequence that included a laZzzy-generated injector targeting notepad.exe, more shellcode, and final .NET malware delivering DcRat, AsyncRAT, XWorm RAT, and PureHVNC.
The tradecraft closely matches activity previously attributed to DDGroup, a long-running cybercrime actor tied to phishing campaigns that weaponize search-ms and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader, along with dynamic DNS infrastructure, open-source tooling such as Freeze.rs and dufs, and repeated process injection into notepad.exe. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to URLhaus to speed blocking.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
The cyber.wtf article documents how the Pyarmor 9.0.7 Pro runtime was reverse engineered, including its AES-GCM handling and modified marshal logic, to statically unpack protected Python malware stages.
The Medium write-up attributes the broader search-ms and WebDAV malware delivery activity to a threat actor named DDGroup. It links the actor to commodity malware families including XWorm and AsyncRAT and to tooling such as dufs and a likely Freeze.rs-derived crypter.
Trellix published research describing how attackers abused the Windows search-ms URI handler against Windows users. The technique allowed redirection to attacker-controlled remote locations such as WebDAV shares.
In August 2023, the researcher observed an invoice-themed phishing email with a malicious PDF attachment that lured a victim into a search-ms redirect opening attacker-hosted content. Antivirus blocked execution in that specific case, preventing recovery of the final payload.
The researcher says DDGroup was among the early actors using OneNote files for malware delivery in 2023.
The article says DDGroup had been mentioned indirectly in public reporting since February 2022, though it had not yet been specifically named or described as a distinct actor.
The researcher states the threat cluster later named DDGroup can be tracked back to at least late 2019. The activity was linked across more than 110 dynamic DNS domains and 94 IP addresses.
The researchers reported the campaign's observed domains and download URLs to URLhaus to speed blocking of the malicious infrastructure.
Researchers analyzed a phishing campaign using an unpaid-invoice SVG lure that led through HTM, WebDAV, VBScript, batch, and Pyarmor-protected Python stages to shellcode, a laZzzy-style injector, and final .NET malware. The campaign delivered DcRat, AsyncRAT, XWorm RAT, and PureHVNC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Trellix reported a phishing campaign that abuses the Windows `search-ms` and `search` URI protocol handlers to push victims from emails, HTML attachments, PDFs, or compromised websites into Windows Explorer views populated with attacker-controlled remote files. The activity relies on JavaScript or script-based redirects to remote WebDAV searches, where malicious `.lnk` files are presented as familiar local search results, lowering suspicion and increasing the likelihood of execution. Researchers observed multiple delivery and execution chains involving HTML, PowerShell, ISO, ZIP, DLL, VBS, and EXE files, with payloads ultimately deploying **AsyncRAT** and **Remcos RAT**. The campaign used SSL-encrypted traffic, rapidly rotated infrastructure and files, and disguised artifacts with deceptive filenames and icons; in some cases, execution was triggered through `regsvr32.exe` or PowerShell. Trellix said the technique can provide initial access from a simple URL visit and recommended mitigating the threat by disabling the vulnerable URI handlers through registry removal.
Aug 1, 2026
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026