Multi-Stage Malware Campaign Utilizing Obfuscated VBS and PNG Loaders

• •The campaign uses obfuscated VBS and PNG files to deliver malicious payloads.
• •LevelBlue’s MDR SOC detected the initial malware, revealing a sophisticated infrastructure.
• •Defenders are advised to restrict execution of high-risk scripts and monitor for in-memory threats.

A sophisticated multi-stage malware campaign has been identified, leveraging Unicode-obfuscated Visual Basic Script (VBS) loaders and PNG files to execute malicious payloads. The campaign employs a fileless PowerShell loader and can deliver various payloads, including Remcos RAT and UAC bypass DLLs. The threat actor hosts the malware toolkit in openly accessible directories under a .xyz domain and Cloudflare-backed subdomains, facilitating rapid payload changes. Initial detection occurred through LevelBlue’s MDR SOC, which quarantined the VBS artifact and uncovered a Base64-encoded PowerShell command that downloaded PNG files containing embedded .NET assemblies. The campaign targets systems without leaving traces on disk, posing a significant risk to organizations. Recommended defenses include restricting execution of high-risk script types and monitoring for suspicious in-memory .NET loading. The current status indicates ongoing activity, necessitating immediate defensive measures.