Operation DualScript is a sophisticated, multi-stage malware campaign primarily targeting cryptocurrency users and financial services. It leverages Windows Scheduled Tasks (T1053.005) and VBScript launchers to maintain persistence on infected systems while minimizing disk footprint and forensic artifacts. The campaign operates through two parallel infection chains. The first chain uses a web-based PowerShell loader (T1059.001) to deploy a cryptocurrency clipboard hijacker (T1113), which monitors clipboard data to intercept cryptocurrency wallet addresses and transaction details, redirecting funds to attacker-controlled wallets. The second chain executes the RetroRAT implant entirely in memory (T1055, T1059.005), avoiding disk writes to evade detection. RetroRAT acts as a remote access trojan, capturing keystrokes (T1056.001), monitoring user activity (T1057), and tracking interactions with financial services to harvest sensitive credentials and data. The malware establishes a command-and-control (C2) channel (T1041, T1071) for remote control and data exfiltration. It employs various anti-analysis and obfuscation techniques (T1562.001, T1027) to hinder detection and analysis. The campaign abuses trusted system utilities and living-off-the-land binaries, complicating detection efforts. Indicators of compromise include multiple file hashes and domains such as anycourse.net and thewpiratebay.st. While no CVEs or known exploits are currently associated, the campaign's stealth and targeted financial theft capabilities make it a significant threat to cryptocurrency users and financial institutions.

The impact of Operation DualScript is primarily financial theft through the interception of cryptocurrency transactions and theft of sensitive financial credentials. By hijacking clipboard data, the malware can redirect cryptocurrency payments to attacker-controlled wallets, resulting in direct monetary loss for victims. The RetroRAT implant's keylogging and user activity monitoring capabilities enable attackers to harvest login credentials, two-factor authentication tokens, and other sensitive data, potentially leading to broader account compromise and fraudulent transactions. The use of in-memory execution and living-off-the-land techniques reduces the likelihood of detection by traditional antivirus and endpoint detection systems, allowing prolonged access and data exfiltration. Organizations involved in cryptocurrency trading, financial services, and users of Windows systems are at risk. The campaign could lead to reputational damage, regulatory penalties, and financial losses. Additionally, the stealthy nature of the malware complicates incident response and forensic investigations, increasing remediation costs and operational disruption.

1. Implement strict application whitelisting to prevent unauthorized execution of PowerShell scripts and VBScript launchers, especially those initiated via Windows Scheduled Tasks. 2. Monitor and audit Windows Scheduled Tasks for suspicious or unauthorized entries, focusing on tasks that execute PowerShell or VBScript components. 3. Deploy advanced endpoint detection and response (EDR) solutions capable of detecting in-memory execution, living-off-the-land techniques, and anomalous PowerShell activity. 4. Enable PowerShell logging (Module Logging, Script Block Logging, and Transcription) and regularly review logs for suspicious commands or scripts. 5. Use clipboard monitoring tools or endpoint security solutions that can detect and alert on clipboard hijacking attempts. 6. Restrict PowerShell execution policies to limit script execution to signed and trusted scripts only. 7. Educate users about the risks of clipboard hijacking and encourage verification of cryptocurrency wallet addresses before transactions. 8. Block or monitor network traffic to known malicious domains and IP addresses associated with the campaign's C2 infrastructure. 9. Employ multi-factor authentication (MFA) on all financial and cryptocurrency-related accounts to reduce the risk of credential misuse. 10. Conduct regular threat hunting exercises focusing on indicators of compromise such as the provided file hashes and suspicious domains. 11. Keep all systems and security tools updated to ensure the latest detection capabilities against emerging threats.