Beware of Phishing Email Disguised as Quotation Inquiry (SnakeKeylogger)

A phishing campaign impersonates purchasing team personnel with quotation inquiry emails containing compressed attachments. Extracted JavaScript files execute obfuscated PowerShell scripts that decrypt and run multi-stage payloads using AES-256-CBC and XOR encryption. The attack uses process hollowing to inject the final payload into aspnet_compiler.exe. The payload is SnakeKeylogger, an infostealer that collects browser credentials, system information, and keylogging data, exfiltrating it via SMTP or Telegram to attacker infrastructure.

• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30
• Infostealer VOLTA That Has AI Assess Stolen InformationMalware2026-11-09
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• Citrus Ransomware: tactics, techniques, procedures, and links to Toy GhoulsMalware2026-11-11