Hackers Spread VIP Keylogger via Fake Business Emails

Gbhackers •Mayura Kathir • May 28, 2026

Hackers are actively deploying VIP Keylogger through phishing emails disguised as routine business documents, using multi‑layered loaders, steganography, and in‑memory execution to quietly steal credentials and other sensitive data from compromised systems. Recent VIP Keylogger campaigns rely heavily on social engineering, with phishing emails crafted to look like legitimate bank payment notifications, procurement orders, logistics […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

VIP Keylogger Campaign Targets Businesses with Phishing Emails Hackers are deploying VIP Keylogger through phishing emails disguised as routine business documents, targeting organizations to steal sensitive data. These campaigns utilize advanced techniques such as multi-layered loaders and steganography to execute the malware in-memory. The phishing emails often mimic legitimate communications, including bank payment notifications and procurement orders, making them particularly deceptive. The ongoing campaign has been active for several months, indicating a sustained threat to businesses. No specific numbers of affected organizations or systems were provided, but the scope of impact is significant given the nature of the malware. Security professionals are urged to remain vigilant against these types of phishing attacks. Current status indicates that the campaign shows no signs of abating. 2 sources 65

Extracted Entities

Hackers Spread VIP Keylogger via Fake Business Emails

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)