Hackers Deploy VIP Keylogger Through Phishing Emails Masquerading as Business Documents

Cybersecuritynews •Tushar Subhra Dutta • May 28, 2026

Hackers are using deceptive phishing emails dressed up as routine business documents to spread a dangerous malware strain known as VIP Keylogger. The campaign has been active for months, with attackers showing absolutely no signs of slowing down. VIP Keylogger is part of a broader wave of information-stealing malware that has taken over the threat […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

VIP Keylogger Campaign Targets Businesses with Phishing Emails Hackers are deploying VIP Keylogger through phishing emails disguised as routine business documents, targeting organizations to steal sensitive data. These campaigns utilize advanced techniques such as multi-layered loaders and steganography to execute the malware in-memory. The phishing emails often mimic legitimate communications, including bank payment notifications and procurement orders, making them particularly deceptive. The ongoing campaign has been active for several months, indicating a sustained threat to businesses. No specific numbers of affected organizations or systems were provided, but the scope of impact is significant given the nature of the malware. Security professionals are urged to remain vigilant against these types of phishing attacks. Current status indicates that the campaign shows no signs of abating. 2 sources 65

Extracted Entities

Hackers Deploy VIP Keylogger Through Phishing Emails Masquerading as Business Documents

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (3)