Back Gbhackers

Remcos RAT Attack Uses Obfuscated Scripts, Trusted Windows Tools

Gbhackers •Mayura Kathir • April 2, 2026

Remcos RAT operators are abusing obfuscated scripts and trusted Windows binaries to deliver a stealthy, largely fileless infection chain that runs almost entirely in memory and evades traditional defenses. The attack starts with a phishing email carrying a ZIP archive named “MV MERKET COOPER SPECIFICATION.zip,” designed to resemble a legitimate business specification document and lure […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Stealthy Remcos RAT Campaign Utilizes Obfuscated Scripts in Phishing Attack A new Remcos RAT campaign has been identified, employing obfuscated scripts and trusted Windows binaries to execute a largely fileless infection chain. The attack initiates through a phishing email containing a ZIP archive named 'MV MERKET COOPER SPECIFICATION.zip,' which mimics a legitimate business document to deceive users. This multi-stage attack does not rely on a single malicious file, making it more challenging for traditional defenses to detect. The infection runs almost entirely in memory, further complicating remediation efforts. Organizations utilizing Windows systems are particularly at risk due to the use of trusted binaries. The campaign highlights the evolving tactics of cybercriminals who are increasingly adept at evading detection. Current status indicates ongoing investigations into the scope and impact of the attack. No specific numbers or CVEs were mentioned in the articles. 2 sources 65

Extracted Entities

Remcos RAT Attack Uses Obfuscated Scripts, Trusted Windows Tools

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)