AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign

A widespread phishing campaign distributing AsyncRAT and Remcos RATs has been observed targeting organizations across manufacturing, media, professional services, agriculture, and chemical industries globally. The attack leverages malicious Excel spreadsheets sent via emails impersonating business communications like purchase orders and payment advice. When macros are enabled, VBA code retrieves HTA payloads through URL shorteners and Cloudflare Workers infrastructure. The multi-stage infection chain employs heavy obfuscation including Base64 encoding, steganography in PNG files, and character substitution. The campaign intensified during June 2026, affecting organizations across Europe, Asia-Pacific, and the Americas. Infrastructure includes distinctive HTA naming conventions using concatenated positive English words. The operation likely uses automation for payload generation and may leverage LLMs for development efficiency.

• Remcos RATMalware2026-11-06
• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• Still Circling: Inside the Operator Behind the GitHub LoaderMalware2026-08-29
• Illegal Streaming Fronts a $7M Dropcatch Domain OperationMalware2026-08-13
• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10