DesckVB RAT emerged in February 2026 through a sophisticated malspam campaign utilizing a dynamic delivery kit that personalizes lures on-the-fly by extracting victim email addresses and pulling company logos in real-time. The attack chain routes through Google's DoubleClick domain to evade email gateways before delivering a five-stage infection: HTML redirect, JScript loader, PowerShell dropper, .NET loader, and finally the RAT itself. The malware employs extensive anti-analysis techniques including sandbox detection, forced reboots upon detection, and in-memory execution via .NET reflection. Once established, it patches AMSI and ETW at the native API level, injects into legitimate Microsoft-signed binaries like InstallUtil.exe and MSBuild.exe, and establishes persistence through registry keys and scheduled tasks. The RAT communicates with DDNS-based C2 infrastructure on non-standard ports, performs system reconnaissance including GPU enumeration possibly for crypto mining, and can deliver additional payl...
A Russian-speaking threat actor is conducting a large-scale phishing campaign targeting travelers by registering over 4,300 fake hotel and travel-related domains impersonating brands like Airbnb and Booking.com. The campaign uses sophisticated phishing sites with customized pages, fake CAPTCHA, and multilingual support to appear legitimate. Malicious emails redirect victims through multiple sites before landing on phishing pages designed to steal payment card data. The attacker continuously registers new domains with travel-related naming conventions, focusing on specific registrars. The phishing kit collects data in real-time and contains Russian language elements. This campaign poses a medium severity risk due to its scale, sophistication, and potential financial impact on victims. European organizations in the travel, hospitality, and financial sectors should be vigilant. Countries with high tourism and travel service usage, such as the UK, Germany, France, Spain, and Italy, are most likely to be affected. Mitigation requires targeted detection of phishing domains, enhanced email filtering, user awareness training focused on travel scams, and collaboration with domain registrars to disrupt domain registrations.
This article explores a new obfuscation technique used by threat actors to conceal malware within bitmap resources embedded in benign 32-bit .NET applications. The malware executes through a multi-stage process of extracting, deobfuscating, loading, and executing secondary payloads. The analysis focuses on a sample from recent malspam campaigns targeting financial organizations in Turkey and logistics sectors in Asia. The malware uses steganography to hide its payloads, making it challenging to detect. The article details the technical analysis of each stage, from the initial payload to the final execution of malware families like Agent Tesla, XLoader, and Remcos RAT. It also provides guidance on how to overcome this obfuscation technique using debugging methods.
