How VBScript Malware Evades Detection Using Trusted Tools Copy

Three VBScript-based malware campaigns target victims primarily in Brazil and Portugal via phishing emails using fake legal and financial documents. These campaigns deliver Overlord RAT, Lampion trojan, and an unknown RAT through multi-stage execution chains involving obfuscated VBScript, batch files, and DLL side-loading with legitimate Windows components. The malware establishes persistence via scheduled tasks and registry modifications, evades detection by adding exclusions to Windows Defender and checking for virtual environments, and uses cloud services for payload delivery. Command and control infrastructure is based in Brazil.

• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23
• 2026 Year End Phishing LuresCampaign2026-10-22
• Machine speed attacks require machine speed detection and responseAnalysis2026-10-22