This campaign uses phishing emails with malicious Excel attachments containing VBA macros. When macros are enabled, the VBA code retrieves HTA payloads through URL shorteners and Cloudflare Workers infrastructure. The multi-stage infection employs advanced obfuscation techniques including Base64 encoding, steganography in PNG images, and character substitution to evade detection. The payloads delivered are AsyncRAT and Remcos RATs, which provide remote access capabilities to attackers. The campaign targets diverse industries worldwide and uses automation and possibly large language models to generate payloads efficiently. The HTA payloads have distinctive naming conventions using concatenated positive English words.

Successful exploitation results in the installation of AsyncRAT or Remcos RATs, which enable attackers to gain remote access and control over infected systems. This can lead to data theft, espionage, lateral movement within networks, and potential disruption of business operations. The campaign's use of multi-stage infection and heavy obfuscation complicates detection and response efforts.

No official patch or fix applies as this is a phishing and malware distribution campaign. Mitigation focuses on user awareness to avoid enabling macros in unsolicited or unexpected Excel attachments. Email filtering to block phishing emails and URL shorteners used in the attack chain can reduce exposure. Endpoint detection and response solutions should be tuned to detect obfuscated VBA macros, HTA payloads, and behaviors associated with AsyncRAT and Remcos. Organizations should follow best practices for macro security and restrict execution of HTA files where possible.