AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign

A global phishing campaign targets business functions with emails carrying malicious Excel attachments that initiate a multi-stage infection chain when macros are enabled. The attack uses layered obfuscation, including HTA scripts, PowerShell, encoded payloads, and steganography in PNG files, to deliver and execute Remote Access Trojans such as Remcos and AsyncRAT in a largely fileless manner. It achieves scale and persistence through high variability, automation, disposable infrastructure, and consistent patterns that help evade detection despite relatively simple techniques.

• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10
• Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 ImplantMalware2026-11-09
• The Industry Leader in Enterprise Brand ProtectionPhishing2026-11-09
• Remcos RATMalware2026-11-06