This threat involves a targeted malware campaign against Thailand's healthcare sector leveraging spear-phishing with malicious RAR archives. The archives contain Rouki-obfuscated batch loaders and executable payloads that execute a multi-stage infection process. Payload delivery is facilitated through GitHub-hosted components, and persistence is maintained using the Windows Startup folder. The final payload is a Python-based information stealer designed to collect sensitive browser data including credentials, session information, and cookies. Data exfiltration is conducted through the Telegram Bot API. The campaign demonstrates sophisticated tradecraft including script obfuscation, use of bundled Python interpreters, and multi-stage payload deployment. The operational window is from April to June 2026, with all samples uploaded from Thailand.

The campaign compromises targeted systems within Thailand's healthcare sector by stealing sensitive browser credentials, session data, and cookies, potentially leading to unauthorized access to user accounts and sensitive information. The use of obfuscated scripts and multi-stage payloads complicates detection and mitigation efforts. Data exfiltration via Telegram Bot API enables attackers to remotely collect stolen information. This could result in privacy breaches, disruption of healthcare operations, and potential exposure of confidential patient or organizational data.

No official patch or fix is available as this is a malware campaign rather than a software vulnerability. Organizations should focus on user awareness training to recognize spear-phishing attempts, especially those involving RAR archives. Implement email filtering to block malicious attachments and monitor for unusual outbound traffic such as connections to Telegram Bot API endpoints. Employ endpoint detection solutions capable of identifying obfuscated scripts and unauthorized persistence mechanisms like Startup folder modifications. Since the campaign uses GitHub for payload hosting, monitoring and restricting access to suspicious external repositories may also help. Regularly update antivirus and endpoint protection tools to detect known indicators of compromise. Patch status is not applicable; mitigation relies on detection and prevention controls.