The threat is a malware campaign utilizing AutoIT scripts to perform process injection. It begins with a phishing email delivering a RAR archive containing a VBS script that decodes a Base64 payload and decompresses it using PowerShell. The payload drops three files: an AutoIT3 interpreter executable, an AutoIT script, and encoded shellcode. The AutoIT script decodes the shellcode (XOR key 0xEC), launches the legitimate Windows charmap.exe process, and injects the shellcode into it using Windows API calls (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, CloseHandle). The injected shellcode installs VIPKeylogger malware which communicates with a remote server. Persistence is established via a registry Run key. This demonstrates AutoIT's capability to perform sophisticated payload injection and malware delivery.

The malware enables remote code execution via process injection into a trusted Windows process (charmap.exe), facilitating stealthy execution of a keylogger (VIPKeylogger). This compromises user confidentiality by logging keystrokes and potentially exfiltrating sensitive information. The persistence mechanism ensures the malware survives system reboots. The use of legitimate system utilities and AutoIT scripting complicates detection and removal.

No official patch or fix is available as this is a malware campaign rather than a software vulnerability. Mitigation involves user education to recognize phishing emails, blocking malicious attachments, and employing endpoint detection solutions capable of identifying AutoIT-based injection techniques and suspicious use of charmap.exe. Since no vendor advisory or patch is provided, patch status is not applicable. Monitoring for persistence registry keys and unusual process injection behavior is recommended.