Threats Tagged 'powershell obfuscation'

Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate ChatGPT models, directing victims through sponsored Google ads to malicious Custom GPTs titled 'Plus 5.6'. These instances served fake service availability notices, redirecting users to Google Sites pages hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. Victims were tricked into executing PowerShell commands that downloaded malicious MSI installers. The attack chain employed DLL sideloading through legitimate Canon-signed and later Stardock-signed executables, establishing dual persistence mechanisms via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and ultimately deployed a feature-rich remote access trojan with capabilities including remote desktop, browser hijacking, credential theft, and follow-on payload delivery. Huntress investigated approximately 40 incidents linked to this campaign, with confirmed Cus...

A sophisticated phishing campaign impersonates legitimate business entities including UPS and the Malaysian Inland Revenue Board to distribute Phantom Stealer v3.5.0. The attack begins with convincing emails containing compressed archives housing malicious JavaScript files. Once executed, the JavaScript launches obfuscated PowerShell scripts that operate entirely in memory, deploying multiple stages of encrypted and encoded payloads. The infection chain utilizes Base64 encoding, AES encryption, and XOR ciphering to conceal its activities. The final payload, Phantom Stealer, harvests credentials from browsers, cryptocurrency wallets, messaging applications, and system information before exfiltrating stolen data via SMTP over port 587 using STARTTLS encryption. The multi-layered approach significantly reduces on-disk footprint and employs reflective code loading and process injection into legitimate binaries to evade traditional security defenses.

MediumMalwareMalaysia#reflective loading#smtp exfiltration#multi-stage attack