A multi-stage steganographic loader campaign has been identified that distributes diverse malware families globally, primarily targeting Indian organizations through phishing emails with archive attachments disguised as financial documents related to GST, NEFT, RTGS, and IMPS transactions. The loader uses fileless techniques, executing payloads in memory and embedding them within .NET Bitmap objects to avoid disk artifacts. The campaign deploys various malware including Remcos RAT, Agent Tesla, MassLogger, Phantom Stealer, Dark Cloud, Red Line Stealer, Snake keyloggers, Formbook, and xworm. These payloads establish persistence via registry Run keys, perform process hollowing, steal browser credentials, record audio and webcam, and exfiltrate data to command-and-control servers. The operation resembles a loader-as-a-service model, supporting multiple threat actors worldwide.

The campaign enables attackers to deploy multiple malware families capable of credential theft, surveillance (audio and webcam recording), persistence on infected systems, process hollowing to evade detection, and data exfiltration to attacker-controlled infrastructure. Targeted organizations, primarily in India, face risks of sensitive financial and personal data compromise, espionage, and potential further network compromise.

No official patch or fix is available as this is a malware campaign rather than a software vulnerability. Mitigation should focus on user awareness to recognize phishing emails, blocking archive attachments with suspicious financial document names, and employing endpoint detection solutions capable of identifying fileless execution and steganographic payloads. Network defenses should monitor for known indicators of compromise such as the provided hashes. Since this is not a cloud service, remediation depends on organizational security controls and incident response capabilities.