Back Feeds.4Sysops

Google DoubleClick abused to distribute DesckVB RAT via automated phishing

Feeds.4Sysops •IT News • June 3, 2026

A new malspam campaign leverages the legitimate Google DoubleClick domain to bypass security filters and deliver the DesckVB remote access trojan. The attack begins with an HTML attachment that redirects users through Google's infrastructure to a dynamically branded landing page. This automated kit scales the operation by pulling company logos and location details based on the recipient's email address. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DesckVB RAT Campaign Exploits Google DoubleClick for Malspam Delivery In May 2026, a malspam campaign utilizing the Google DoubleClick domain was identified, delivering the DesckVB remote access trojan (RAT). The attack begins with an HTML email attachment that redirects users through Google's infrastructure to a dynamically branded phishing page. This automated kit personalizes the lure by pulling in company logos and location details based on the recipient's email address, enhancing its believability. Once a victim interacts with the lure, the DesckVB RAT executes a multi-stage malware delivery process, primarily operating in memory to evade detection. The RAT can control infected systems remotely, allowing attackers to harvest data and execute commands. This campaign highlights the increasing sophistication of malspam operations, which are becoming more scalable and harder to detect. Security professionals are urged to remain vigilant against such evolving threats. 5 sources 68

Extracted Entities

Google DoubleClick abused to distribute DesckVB RAT via automated phishing

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)