Back Cybersecuritynews

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Cybersecuritynews •Tushar Subhra Dutta • March 25, 2026

A sophisticated multi-stage malware campaign has surfaced, deploying obfuscated Visual Basic Script (VBS) files, PNG-embedded loaders, and remote access trojans (RATs) to target systems without leaving a trace on disk. What began as a routine endpoint detection in early 2026 quickly revealed itself to be far more organized than a single opportunistic attack, exposing a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multi-Stage Malware Campaign Utilizing Obfuscated VBS and PNG Loaders A sophisticated multi-stage malware campaign has been identified, leveraging Unicode-obfuscated Visual Basic Script (VBS) loaders and PNG files to execute malicious payloads. The campaign employs a fileless PowerShell loader and can deliver various payloads, including Remcos RAT and UAC bypass DLLs. The threat actor hosts the malware toolkit in openly accessible directories under a .xyz domain and Cloudflare-backed subdomains, facilitating rapid payload changes. Initial detection occurred through LevelBlue’s MDR SOC, which quarantined the VBS artifact and uncovered a Base64-encoded PowerShell command that downloaded PNG files containing embedded .NET assemblies. The campaign targets systems without leaving traces on disk, posing a significant risk to organizations. Recommended defenses include restricting execution of high-risk script types and monitoring for suspicious in-memory .NET loading. The current status indicates ongoing activity, necessitating immediate defensive measures. 3 sources 73

Extracted Entities

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)