A new Remote Access Trojan known as DesckVB has been targeting systems in 2026, using obfuscated JavaScript and a fileless .NET loader to stay hidden from traditional security tools. <\/p>\n
The malware gives attackers full remote control over a victim\u2019s machine, making it a serious threat for individuals and organizations alike.<\/p>\n
DesckVB RAT starts its infection chain with a heavily obfuscated JavaScript<\/a> file that, once executed, silently drops a PowerShell script into the\u00a0 The JavaScript replicates its code into PowerShell and text files, giving the malware multiple ways to run. What makes this threat particularly dangerous is that it avoids writing most of its core components to disk, making it much harder for conventional antivirus tools to catch it.<\/p>\n Point Wild analysts from the LAT61 Threat Intelligence Team identified and examined DesckVB RAT<\/a> in detail, uncovering how it uses layered obfuscation to hide its true purpose at every stage of execution. <\/p>\n Their research found that the malware combines Base64 encoding with URL string reversal to conceal its command-and-control (C2) server addresses, a tactic designed to trick automated scanning tools. <\/p>\n The overall structure of the malware suggests it was built with a clear understanding of how modern security defenses work.<\/p>\n Once fully deployed, DesckVB RAT loads a .NET assembly directly into memory using .NET reflection techniques, bypassing the need to leave any files on the hard drive. <\/p>\n This in-memory execution method allows the malware to run its harmful routines without triggering many standard file-based detection systems. <\/p>\n At runtime, the malware activates several harmful capabilities, including keylogging, webcam access, antivirus detection evasion, and encrypted communication with its C2 server.<\/p>\n The overall impact of DesckVB RAT<\/a> is broad and concerning. Attackers who deploy it can steal sensitive information, monitor user activity in real time, and maintain long-term access to a compromised system without raising immediate alarms. <\/p>\n Its use of encrypted HTTPS traffic over port 443 allows it to blend in with normal internet activity, making network-level detection just as difficult.<\/p>\n The most notable aspect of DesckVB RAT is how it moves through its infection stages without relying on traditional file drops. The malware\u2019s flow begins with the JavaScript file, acting as the first entry point. <\/p>\n This file is heavily obfuscated and drops a PowerShell file directly into\u00a0 The PowerShell script first checks for internet connectivity by pinging Google, then attempts to connect to a malicious external domain. The C2 domain is hidden using Base64 encoding combined with string reversal. <\/p>\n The malware uses the legitimate Windows tool\u00a0 From there, the script loads\u00a0 The Execute method within this loader uses\u00a0 This process injection approach allows the malware to hide inside trusted processes and avoid drawing attention.<\/p>\n The final payload,\u00a0 Network captures confirm the malware transmits its module names and internal activity to its remote server.<\/p>\n Security teams should watch for unusual PowerShell execution, unexpected use of\u00a0 Blocking script execution from\u00a0 Keeping endpoint protection software current also remains a critical defense, as detection tools<\/a> have already shown the ability to flag key components of this malware.<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post DesckVB RAT Uses Obfuscated JavaScript and Fileless .NET Loader to Evade Detection<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nC:UsersPublic<\/code>\u00a0directory on the target system. <\/p>\nThe Fileless Infection Chain<\/strong><\/h2>\n
![\"Shows](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi6Y_PVMD6EAfzdh7kRyFCKrX1lnDH2ebA9yKHwLD6Apoyuuufib_FsKVZ5n25cIb72iTRWq_VxYR-hBbL12uV2gmlA68qIGra_AVYQ2Vtsd8ifO-awaB9ZOYl402GxxK60mKNvWpmXpVYhe-Nny14z4UaEtGTUXDtxWpvTHHvMwMTBGvI6Zph5Aw52VwU\/s16000\/Shows%2520flow%2520of%2520malware%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
C:UsersPublic<\/code>, keeping its activities within commonly overlooked system folders.<\/p>\n![\"JS](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjxb6nPtpU7r2VsU_a4gLhHlgwGB2c7-oU_l-vK0Al9_R_zwnNUjlz51oqSii1tAp6xTK2LeyReFYF9JNiUEaSTU2EpHhRiDY1-cObcxqYWozVoPvEKbNb6DLQcSsl5xrQw1YndxF2ru43Jr_sRuoTAnD2Y_HgoWNvt6YZQFcBlQAYtnvK-G9CmtVrWqKk\/s16000\/JS%2520obfuscated%2520file%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
InstallUtil.exe<\/code>\u00a0to execute its payload \u2014 a known technique for bypassing application control policies.<\/p>\nClassLibrary3.dll<\/code>\u00a0directly into memory and invokes the obfuscated method\u00a0prFVI<\/code>, which then loads\u00a0ClassLibrary1.dll<\/code>.<\/p>\nCreateProcessA<\/code>\u00a0to spawn a new process in a suspended state before injecting the malicious payload. <\/p>\n![\"Obfuscated](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhO8l30Dsx3Pbz_t7eIV-F_99AFWltTlG4jpWxOaK54C2bu3nDi6UZbkhNHWWwvveFm5z35cV3ei9KrbCZcj09Kuiyv6hyphenhyphenMrkwRFhhmNEwvCoPGeoqkC3WrgrK8wQTcdpmtCO0I9tIxGsCejPrXlP4tztdFokDqrGU-TMBb7XCA325izwHKzZeOApgD1t0\/s16000\/Obfuscated%2520method%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
![\"Encoded](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEig73pxa0asLauNOGtlG0BCoKhz_-2wOEBqCSK-UKPlxWUgknKl8qmCtMYu2pvg2BadbD6ZgGoMgtcC3rcdTAH9KEgxAfD7OPgX0jX28lpD9USeoc2XQxS6jgpplcqc8ZRtpzj_krZVIylBWU6_zqVLdyvwI4QcqScKaP3qqjeSL94ZPBGbljR1iO-jG5U\/s16000\/Encoded%2520String%2520Array%2520%28Source%2520-%2520Point%2520Wild%29.webp?ssl=1\")
Microsoft.exe<\/code>, carries encoded string arrays that hold a hidden runtime configuration. Once active, it drops\u00a0Keylogger.dll<\/code>\u00a0directly into memory and begins C2 communication over\u00a0manikandan83.mysynology.net<\/code>\u00a0on port\u00a07535<\/code>, resolving to IP\u00a045.156.87.226<\/code>. <\/p>\nInstallUtil.exe<\/code>, and outbound connections to unknown domains or IPs. <\/p>\nC:UsersPublic<\/code>\u00a0and enabling detailed PowerShell script<\/a> logging are practical first steps to catching this threat early. <\/p>\n