Multi

Gbhackers •Mayura Kathir • June 22, 2026

A suspicious file named “GST Debit Note Apr_26.com,” which triggered a deeper investigation and revealed a polished, multi-stage steganographic loader delivering Remcos RAT and multiple infostealers across a global phishing campaign. The initial sample arrived as an archive attachment and unpacked to a 32-bit .NET executable that was unsigned and packed, masquerading as a legitimate […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Uses GST Debit Note to Deploy Remcos RAT A phishing campaign is targeting users in India with a malicious attachment named 'GST Debit Note Apr_26.com.' This attachment is a multi-stage steganographic loader that delivers the Remcos RAT, enabling attackers to gain remote access to infected systems. The loader is sophisticated, allowing for the deployment of multiple infostealers. The attack method involves disguising the malware as a legitimate document, which increases the likelihood of user interaction. The campaign is ongoing and has raised significant concerns among cybersecurity professionals due to its stealth and effectiveness. No specific numbers of affected users or systems have been disclosed, but the global scope of the phishing campaign suggests a wide-reaching impact. Current status indicates heightened vigilance is needed among potential targets. 2 sources 67

Extracted Entities

Multi

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)