Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads
A multi-stage malware campaign has been identified, utilizing obfuscated Visual Basic Script (VBS) files, PNG-embedded loaders, and remote access trojans (RATs) to target systems without leaving traceable files on disk. Initial detection in early 2026…
A multi-stage malware campaign has been identified, utilizing obfuscated Visual Basic Script (VBS) files, PNG-embedded loaders, and remote access trojans (RATs) to target systems without leaving traceable files on disk. Initial detection in early 2026 unveiled a sophisticated framework capable of deploying various malware payloads across different attack chains from a shared infrastructure.
The campaign was first detected through a suspicious VBS file named Name_File.vbs in the \Users\Public\Downloads\ directory. SentinelOne endpoint protection quarantined the file, which contained encoded content that revealed a Base64-encoded PowerShell command designed for further component retrieval from a remote server.
LevelBlue's SpiderLabs Cyber Threat Intelligence team discovered an attacker-controlled domain hosting multiple obfuscated VBS files linked to different malware payloads, including XWorm variants and Remcos RAT. A separate infection chain linked to a fake PDF confirmed the campaign's multi-vector approach.
The campaign was first detected through a suspicious VBS file named Name_File.vbs in the \Users\Public\Downloads\ directory.
The attacker's infrastructure utilizes openly accessible directories within the domain news4me[.]xyz , such as /coupon/ , /protector/ , and /invoice/ . Each directory supports distinct roles in the attack, enabling quick updates and scalability. The infection mechanism begins with a VBS file that launches a Base64-encoded PowerShell command, functioning as a fileless loader.
The PowerShell command uses the Net.WebClient class to fetch a remote PNG image. Embedded within the image are payloads that load directly into memory, bypassing typical file-based security controls. The technique ensures stealthy and persistent remote access through Remcos RAT and privilege escalation via a UAC Bypass DLL.
Organizations are advised to restrict .vbs and .bat execution from user-writable directories and enforce constrained PowerShell policies with in-memory execution logging. Network-level defenses should block WebDAV-based connections and filter .xyz top-level domains to limit access to identified attacker infrastructure. Endpoint protection should be complemented with thorough threat intelligence investigations.
Based on reporting by Cyber Security News.