Threats Tagged 'vbs script'

A sophisticated phishing campaign has been identified where attackers impersonate employees of a US company, sending emails that claim to contain transaction receipts. Recipients are urged to verify fund deposits by opening an attached PDF file. The malicious PDF displays a fake Adobe Flash Player update prompt, which when clicked, downloads a VBS script. This script executes with administrator privileges, displays a decoy payment receipt document, and silently installs ScreenConnect remote management software via an MSI package. The installation establishes persistent remote access to the compromised system, enabling attackers to execute commands, transfer files, and deploy additional payloads using legitimate administrative tools in a Living-off-the-Land attack technique.

The Batavia spyware campaign, active since July 2024, targets Russian industrial enterprises through phishing emails containing malicious links disguised as contract documents. The infection process involves three stages: a VBS script downloader, the WebView.exe spyware, and the javav.exe module. These components collect and exfiltrate various types of files, including system logs, office documents, and screenshots. The malware employs techniques to avoid duplicate file uploads and can download additional payloads. Over 100 users across dozens of organizations have been affected. The campaign highlights the importance of comprehensive cybersecurity measures and employee training to mitigate such threats.

MediumCampaignRussiaGermanyFrance+3#spyware#uac bypass#phishing