Threats Tagged 'jscript loader'

DesckVB RAT is a malware strain first observed in February 2026, delivered via a sophisticated malspam campaign that dynamically personalizes lures using victim email addresses and company logos. The infection chain involves multiple stages including HTML redirects, JScript loaders, PowerShell droppers, and . NET loaders, culminating in an in-memory RAT that employs advanced anti-analysis techniques such as sandbox detection and forced reboots. The RAT patches AMSI and ETW at the native API level, injects into legitimate Microsoft-signed binaries, and establishes persistence through registry keys and scheduled tasks. It communicates with DDNS-based command and control servers over non-standard ports, performs system reconnaissance including GPU enumeration, and is capable of delivering additional payloads. No official patch or remediation guidance is provided, and no known exploits in the wild have been reported as of the publication date.