๐จ New #phishing wave targets business teams with Google Storage-hosted lures. Steals credentials, drops #Remcos RAT, gives full remote control, keylogging, and persistence.
Trusted infrastructure makes this especially dangerous. Read the breakdown๐
https://any.run/cybersecurity-blog/phishing-google-drive-remcos/?utm_source=mastodon&utm_medium=post&utm_campaign=phishing_google_drive_remcos&utm_content=linktoblog&utm_term=140426
Top 10 last week's threats by uploads ๐
โฌ๏ธ #Asyncrat 832 (693)
โฌ๏ธ #Xworm 730 (640)
โฌ๏ธ #Gh0st 391 (396)
โฌ๏ธ #Stealc 330 (409)
โฌ๏ธ #Salatstealer 320 (320)
โฌ๏ธ #Quasar 309 (283)
โฌ๏ธ #Vidar 274 (343)
โฌ๏ธ #Remcos 244 (296)
โฌ๏ธ #Dcrat 242 (238)
โฌ๏ธ #Lumma 185 (187)
Explore malware in action:
https://app.any.run/?utm_source=twitter&utm_medium=post&utm_campaign=top_ten&utm_term=130426&utm_content=linktoregister
Top 10 last week's threats by uploads ๐
โฌ๏ธ #Asyncrat 832 (693)
โฌ๏ธ #Xworm 730 (640)
โฌ๏ธ #Gh0st 391 (396)
โฌ๏ธ #Stealc 330 (409)
โฌ๏ธ #Salatstealer 320 (320)
โฌ๏ธ #Quasar 309 (283)
โฌ๏ธ #Vidar 274 (343)
โฌ๏ธ #Remcos 244 (296)
โฌ๏ธ #Dcrat 242 (238)
โฌ๏ธ #Lumma 185 (187)
Explore malware in action:
https://app.any.run/?utm_source=twitter&utm_medium=post&utm_campaign=top_ten&utm_term=130426&utm_content=linktoregister
Top 10 last week's threats by uploads ๐
โฌ๏ธ #Asyncrat 832 (693)
โฌ๏ธ #Xworm 730 (640)
โฌ๏ธ #Gh0st 391 (396)
โฌ๏ธ #Stealc 330 (409)
โฌ๏ธ #Salatstealer 320 (320)
โฌ๏ธ #Quasar 309 (283)
โฌ๏ธ #Vidar 274 (343)
โฌ๏ธ #Remcos 244 (296)
โฌ๏ธ #Dcrat 242 (238)
โฌ๏ธ #Lumma 185 (187)
Explore malware in action: https://app.any.run/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_term=130426&utm_content=linktoregister#register
๐จ ๐ฃ๐ต๐ถ๐๐ต๐ถ๐ป๐ด ๐๐ถ๐ฎ ๐๐ผ๐ผ๐ด๐น๐ฒ ๐ฆ๐๐ผ๐ฟ๐ฎ๐ด๐ฒ ๐๐ฏ๐๐๐ฒ ๐๐ฒ๐ฎ๐ฑ๐ถ๐ป๐ด ๐๐ผ ๐ฅ๐๐ง ๐๐ฒ๐ฝ๐น๐ผ๐๐บ๐ฒ๐ป๐: ๐๐ฒ๐๐ฒ๐ฐ๐ ๐๐ ๐๐ฎ๐ฟ๐น๐
We identified a multi-stage #phishing campaign using a Google Drive-themed lure and delivering #Remcos RAT. Attackers place the HTML on storage[.]googleapis[.]com, abusing trusted infrastructure instead of hosting the phishing page on a newly registered domain.
โ๏ธ ๐ง๐ต๐ฒ ๐ฐ๐ต๐ฎ๐ถ๐ป ๐น๐ฒ๐๐ฒ๐ฟ๐ฎ๐ด๐ฒ๐ ๐ฅ๐ฒ๐ด๐ฆ๐๐ฐ๐.๐ฒ๐ ๐ฒ, ๐ฎ ๐น๐ฒ๐ด๐ถ๐๐ถ๐บ๐ฎ๐๐ฒ ๐๐ถ๐ด๐ป๐ฒ๐ฑ ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐/.๐ก๐๐ง ๐ฏ๐ถ๐ป๐ฎ๐ฟ๐ ๐๐ถ๐๐ต ๐ฎ ๐ฐ๐น๐ฒ๐ฎ๐ป ๐ฉ๐ถ๐ฟ๐๐๐ง๐ผ๐๐ฎ๐น ๐ต๐ฎ๐๐ต. Combined with trusted hosting, this makes reputation-based detection unreliable and lowers alert priority during triage. File reputation alone is not enough. Detection depends on behavioral analysis and sandboxing.
โ ๏ธ The page mimics a Google Drive login form, collecting email, password, and OTP. After a โsuccessful login,โ the victim is prompted to download Bid-Packet-INV-Document.js, triggering a multi-stage delivery chain:
JS (WSH launcher + time-based evasion) โก๏ธ VBS Stage 1 (download + hidden execution) โก๏ธ VBS Stage 2 (%APPDATA%\WindowsUpdate + Startup persistence) โก๏ธ DYHVQ.ps1 (loader orchestration) โก๏ธ ZIFDG.tmp (obfuscated PE / Remcos payload) โก๏ธ Textbin-hosted obfuscated .NET loader (in-memory via Assembly.Load) โก๏ธ %TEMP%\RegSvcs.exe hollowing/injection โก๏ธ Partially fileless Remcos + C2 ๐จ
๐จโ๐ป See the analysis session and collect #IOCs to speed up detection and response: https://app.any.run/tasks/0efd1390-c17a-49ce-baef-44b5bd9c4a97/?utm_source=mastodon&utm_medium=post&utm_campaign=google_storage_abuse_phishing&utm_term=080426&utm_content=linktoservice
๐ Use this TI Lookup query to pivot from IOCs, review related activity, and validate your detection coverage: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=google_storage_abuse_phishing&utm_content=linktotilookup&utm_term=08042026#%7B%22query%22:%22domainName:%5C%22www.freepnglogos.com%5C%22%20and%20domainName:%5C%22storage.googleapis.com%5C%22%20and%20threatLevel:%5C%22malicious%5C%22%22,%22dateRange%22:30%7D
โก๏ธ Equip your SOC with stronger phishing detection and contain incidents faster: https://any.run/phishing/?utm_source=mastodon&utm_medium=post&utm_campaign=google_storage_abuse_phishing&utm_term=080426&utm_content=linktophishingpage
Top 10 last week's threats by uploads ๐
โฌ๏ธ #Asyncrat 695 (490)
โฌ๏ธ #Xworm 640 (460)
โฌ๏ธ #Stealc 409 (581)
โฌ๏ธ #Gh0st 396 (274)
โฌ๏ธ #Vidar 343 (371)
โฌ๏ธ #Salatstealer 320 (243)
โฌ๏ธ #Remcos 297 (385)
โฌ๏ธ #Quasar 283 (221)
โฌ๏ธ #Dcrat 239 (100)
โฌ๏ธ #Agenttesla 196 (196)
Explore malware in action: https://app.any.run/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_term=060426&utm_content=linktoregister#register
Advanced Fileless Remcos RAT Abusing Native Windows Tools
Pulse ID: 69d2ba26efd7dcef6be56abc
Pulse Link: https://otx.alienvault.com/pulse/69d2ba26efd7dcef6be56abc
Pulse Author: cryptocti
Created: 2026-04-05 19:38:14
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #InfoSec #OTX #OpenThreatExchange #RAT #Remcos #RemcosRAT #Windows #bot #cryptocti
From Inbox to Intrusion: MultiโStage Remcos RAT and C2โDelivered Payloads in Network
This multi-stage fileless Remcos RAT attack leverages a phishing-delivered JavaScript dropper to trigger a reflective PowerShell loader that executes payloads entirely in memory. The infection chain utilizes obfuscation techniques like rotational XOR and Base64 encoding to reconstruct .NET payloads, significantly reducing the disk-based detection footprint. Stealth is maintained by using aspnet_compiler.exe as a LOLBin to proxy malicious execution and dynamically retrieving the final payload from a remote C2 server.
Pulse ID: 69cd1ac8518646002a1a0fbc
Pulse Link: https://otx.alienvault.com/pulse/69cd1ac8518646002a1a0fbc
Pulse Author: AlienVault
Created: 2026-04-01 13:16:56
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#ASPNet #ASPNet_Compiler #CyberSecurity #InfoSec #Java #JavaScript #NET #OTX #OpenThreatExchange #Phishing #PowerShell #Proxy #RAT #Remcos #RemcosRAT #bot #AlienVault
Top 10 last week's threats by uploads ๐
โฌ๏ธ #Stealc 581 (600)
โฌ๏ธ #Asyncrat 493 (541)
โฌ๏ธ #Xworm 460 (509)
โฌ๏ธ #Remcos 389 (272)
โฌ๏ธ #Vidar 371 (368)
โฌ๏ธ #Gh0st 274 (298)
โฌ๏ธ #Salatstealer 243 (195)
โฌ๏ธ #Quasar 221 (185)
โฌ๏ธ #Lokibot 217 (119)
โฌ๏ธ #Agenttesla 196 (216)
Explore malware in action: https://app.any.run/?utm_source=mastodon&utm_medium=post&utm_campaign=top_ten&utm_term=300326&utm_content=linktoregister#register
ANY.RUN
Anonymous ๐๏ธ๐พโ๐ต๐ด๐ต๐ธ 
OTX Bot
SANS Internet Storm Center - SANS.edu - Go Sentinels!