A sophisticated multi-stage malware campaign has surfaced, deploying obfuscated Visual Basic Script (VBS) files, PNG-embedded loaders, and remote access trojans (RATs) to target systems without leaving a trace on disk. <\/p>\n
What began as a routine endpoint detection in early 2026 quickly revealed itself to be far more organized than a single opportunistic attack, exposing a reusable delivery framework capable of pushing different malware payloads across separate attack chains from one shared infrastructure.<\/a><\/p>\n The first sign of the campaign was a suspicious VBS file named\u00a0 SentinelOne endpoint protection caught and quarantined the file before it could fully run. Even so, the encoded content inside the script warranted a closer look. <\/p>\n When decoded, it exposed a Base64-encoded PowerShell command<\/a> with embedded external network references \u2014 a clear signal that the file was designed to pull additional components from a remote server.<\/a><\/p>\n LevelBlue analysts identified that this single endpoint alert<\/a> was a window into a much larger operation. <\/p>\n The investigation, carried out by LevelBlue\u2019s SpiderLabs Cyber Threat Intelligence team, uncovered an attacker-controlled domain hosting multiple obfuscated VBS files, each linked to a different malware payload \u2014 including XWorm variants and Remcos RAT stored as text files. <\/p>\n A separate infection chain tied to a fake PDF was also active on the same infrastructure, confirming the campaign\u2019s deliberate, multi-vector design.<\/a><\/p>\n The attacker\u2019s infrastructure centered on openly accessible directories within the domain\u00a0 Each directory served a distinct role \u2014 staging VBS launchers, hosting obfuscated payload files, or delivering entirely separate infection vectors. <\/p>\n This open-directory setup was not accidental; it let the attacker quickly update, rotate, or expand hosted payloads without modifying the core delivery logic, creating a flexible, scalable system capable of staying operational even after partial detection.<\/a><\/p>\n The infection begins with a VBS file that acts purely as a launcher, carrying no active malicious code of its own. <\/p>\n The script is buried beneath layers of Unicode obfuscation. Stripping those characters exposes the raw encoded script in\u00a0a Base64-encoded PowerShell command that serves as the true engine of the attack.<\/p>\n That PowerShell command functions as a fileless loader. It enforces TLS 1.2 and uses the\u00a0 Instead of pulling a traditional executable, it downloads a PNG image \u2014\u00a0 This assembly, known as PhantomVAI, loads directly into memory via\u00a0 Once running, PhantomVAI passes two URLs into its VAI method for follow-on execution. The first,\u00a0 The second URL delivers\u00a0 Organizations should restrict\u00a0 At the network level, blocking WebDAV-based connections and filtering\u00a0 Endpoint protection<\/a> must be paired with deeper threat intelligence investigation \u2014 stopping one alert is not sufficient when the broader infrastructure remains active and ready to deploy from alternate vectors.<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nName_File.vbs<\/code>, found in the\u00a0UsersPublicDownloads<\/code>\u00a0directory of a compromised endpoint. <\/p>\nnews4me[.]xyz<\/code>, including\u00a0\/coupon\/<\/code>,\u00a0\/protector\/<\/code>, and\u00a0\/invoice\/<\/code>. <\/p>\nInside the Infection Mechanism: VBS to In-Memory RAT Execution<\/strong><\/h2>\n
![\"Name_File.vbs](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhdrNREh90qexqQHDdg0u_XUd0AKWGia6QCTIiKOQ5ki_bRD5b5ZZKxC4V3mEhZR9aFWDOiwXWxu7m4SH66np7k_A6mt7A7tHZwLfndWl1TOCKryPJ6XQE4riGIzypHgIVgVkT8Xth5QinBNZhV4pIVUx3sim-FWOaIIjZopR6CbXWvTZ3_IjP_MA8mqS4\/s16000\/Name_File.vbs%2520content%2520%28Source%2520-%2520LevelBlue%29.webp?ssl=1\")
![\"Name_File.vbs\u00a0Unicode](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhPEK8A3lyMEKF67_EOkYa4PQ4coZ4khyphenhyphenLyTWy8qfvKQ0jKJNfMxJ-OavDebbmHIiiUNox8kTOVEJeXqw_BYIpCDiKmeaZdKiwyy5on086q1gy9oqbOcvYyiWHEWNX4ylNA5N9lxBeB4Gc-wCV5hcdg9KhsC-V790oaoE9MOdFlhMEMvWG3dsuFgCAoy2A\/s16000\/Name_File.vbs%25C2%25A0Unicode%2520removal%2520%28Source%2520-%2520LevelBlue%29.webp?ssl=1\")
Net.WebClient<\/code>\u00a0class to fetch a remote file from an Internet Archive URL.<\/p>\n![\"Name_File.vbs\u00a0decoded](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhWhX8e5a8pNhiaAIbnL98m7Fabb2jXpxycu5JNi1-dVG_LrGbT01_XBGR7RBWEiixdrpe3EFpV-NYEftP53LsyHtslnP2iey0Fj9gvcMsLwf4yS3LhvY65ss-GBuGC2y1M-PaG7avT6WcHigCgpOui3x7c5pSMYQjDHkFAdO4zWnxIwbt4u5tzpzbFg0E\/s16000\/Name_File.vbs%25C2%25A0decoded%2520PowerShell%2520command%2520%28Source%2520-%2520LevelBlue%29.webp?ssl=1\")
MSI_PRO_with_b64.png<\/code>. The file looks ordinary, but hidden inside it \u2014 between custom\u00a0BaseStart<\/code>\u00a0and\u00a0BaseEnd<\/code>\u00a0markers. <\/p>\nReflection.Assembly::Load<\/code>, running entirely in RAM and bypassing most file-based security controls.<\/a><\/p>\nnews4me[.]xyz\/protector\/johnremcos.txt<\/code>, contains an obfuscated string<\/a> that decodes into a working instance of Remcos RAT, giving the attacker persistent remote access to the machine. <\/p>\nuac.png<\/code>, a PNG file carrying a UAC Bypass DLL in the same embedded format \u2014 designed to silently escalate privileges. Together, these payloads hand the attacker full control while leaving virtually no traditional file artifacts behind.<\/a><\/p>\n.vbs<\/code>\u00a0and\u00a0.bat<\/code>\u00a0execution from user-writable directories such as\u00a0UsersPublic<\/code>\u00a0and enforce constrained PowerShell policies with in-memory execution logging. <\/p>\n.xyz<\/code>\u00a0top-level domains can limit access to the attacker infrastructure identified in this campaign. <\/p>\n