The campaign leverages a deceptive fake payment notice disguised as a SWIFT copy to trick victims into downloading a malicious PDF, ultimately leading to the deployment of the remote access trojan (RAT). The PowerShell script downloads an image file that appears harmless but is embedded with the RemcosRAT payload, concealed using steganography a technique that hides malicious code within the image. This link serves as the entry point for the attack, luring victims into a multi-stage infection process designed to deliver RemcosRAT, a malware known for its ability to remotely control infected systems. This campaign demonstrates a clear evolution in malware delivery methods, combining social engineering with obfuscated scripts and hidden payloads to bypass traditional security measures. ???? #MalspamAlert: We’ve spotted a campaign delivering #RemcosRAT, using a fake payment SWIFT copy to lure victims. Researchers at Trustwave SpiderLabs has uncovered a sophisticated malspam campaign distributing the notorious RemcosRAT malware on windows. The email identified in the campaign, as shown in a screenshot provided by Trustwave MailMarshal, includes a message body with a fake payment notice. Organizations are urged to update their security protocols, monitor for the provided IoCs, and educate employees about the risks of opening attachments or clicking links in unexpected emails. This discovery adds to the growing list of Remcos RAT campaigns, a malware strain known for its versatility and use in espionage, data theft, and other malicious activities. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The attached PDF links to an obfuscated JavaScript file that uses ActiveXObject to fetch a second-stage script. Once decoded and executed, the malware establishes a connection to a command-and-control (C2) server, giving attackers remote access to the victim’s system. The use of steganography to conceal the payload within an image file highlights the advanced tactics employed by the attackers to evade detection. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 03 May 2025 14:00:06 +0000