A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally

A sophisticated phishing campaign was identified distributing multiple malware families through a multi-stage loader utilizing steganography and fileless techniques. The infection chain begins with archive attachments containing files disguised as financial documents, primarily targeting Indian organizations using names related to GST, NEFT, RTGS, and IMPS transactions. The loader employs in-memory execution to avoid disk-based artifacts and uses embedded .NET Bitmap objects to conceal payloads. Various malware families have been deployed including Remcos RAT, Agent Tesla, MassLogger, Phantom Stealer, Dark Cloud, Red Line Stealer, Snake keyloggers, Formbook, and xworm. The final payloads establish persistence through registry Run keys, perform process hollowing, steal browser credentials, record audio and webcam, and exfiltrate data to command-and-control infrastructure. The campaign exhibits characteristics of a loader-as-a-service operation serving multiple threat actors globally.

Pulse ID: 6a3ac3d87dd519f2fec1d2ea
Pulse Link: https://otx.alienvault.com/pulse/6a3ac3d87dd519f2fec1d2ea
Pulse Author: AlienVault
Created: 2026-06-23 17:35:20

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AgentTesla #Browser #Cloud #CyberSecurity #FormBook #ICS #India #InfoSec #KeyLogger #Malware #NET #OTX #OpenThreatExchange #Phishing #RAT #Remcos #RemcosRAT #SSL #Steganography #Tesla #Worm #XWorm #bot #AlienVault

🔥 VIRAL

📢 Formbook entregado a través de JavaScript ofuscado - SOC Prime

🔗 https://news.google.com/rss/articles/CBMiiwFBVV95cUxQNkVuQnBuYW1kX3Z5d0VydzYya3dTRGNQZ0xSSmd6MUIwUDBNV1BtV0k3SjVtb2RDMVFlbjdxdTZ1T21weGlNSUdFeHc0eTBqeTJRR3dnVDRWOEtpMmcxWFZFV3JJa2R5VTZkTjFZUlRnZkFiRm5jWWxsbVBFUkxuclgwNkdkSlk0UEpv?oc=5

#Formbook #Javascript #Prime #GlobalFeed #News #ES

<i>Publicado automáticamente por Global Feed Bot</i>

🚀 *The panel others don't want you to find.* 👥 Real Discord Members ...

📢 Xloader v8.1+ : nouvelles techniques d'obfuscation et protocole C2 détaillés
📝 ## 🔍 Contexte

Publié le 31 mars 2026 par ThreatLabz (Zscaler), cet article constitue une analyse technique approf...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-05-xloader-v8-1-nouvelles-techniques-d-obfuscation-et-protocole-c2-detailles/
🌐 source : https://www.zscaler.com/blogs/security-research/latest-xloader-obfuscation-methods-and-network-protocol
#C2_protocol #FormBook #Cyberveille

🎯 Registry abuse helps #malware maintain persistence on infected endpoints. By detonating files in #ANYRUN Sandbox, analysts gain instant threat visibility to accelerate investigations and response.

👨‍💻 See #FormBook and script-based attacks analysis: https://any.run/cybersecurity-blog/how-to-spot-malware-registry-abuse/?utm_source=mastodon&utm_medium=post&utm_campaign=registry_abuse&utm_term=070825&utm_content=linktoblog

#cybersecurity #infosec

🎯 Registry abuse helps #malware maintain persistence and stealth on infected endpoints.
Detonating suspicious files in #ANYRUN Sandbox gives instant visibility into registry activity.

Explore examples, featuring #FormBook and script-based attacks 👇
https://any.run/cybersecurity-blog/how-to-spot-malware-registry-abuse/?utm_source=mastodon&utm_medium=post&utm_campaign=spot_registry_abuse&utm_term=240625&utm_content=linktoblog

#cybersecurity #infosec