Overlord RAT and Marsalek Malware Campaigns Target Users

• •Overlord RAT is spread through WhatsApp phishing targeting Malaysian users.
• •Marsalek operates as a malware-as-a-service platform, using various delivery methods.
• •Both threats are detected by Symantec's Carbon Black products.

A WhatsApp phishing campaign has been identified, targeting Malaysian finance and business users with Overlord RAT, a remote access tool. The attack uses a ZIP archive masquerading as an account statement, containing a Microsoft-signed executable that side-loads an unsigned DLL. The malware employs advanced evasion techniques, including patching AMSI and ETW, and establishes persistence through a hidden folder. Separately, the Marsalek operation has emerged as a malware-as-a-service platform, distributing malware via Telegram and targeting various applications, including cryptocurrency wallets. Both threats are detected by Symantec's Carbon Black products, which block associated malicious indicators. Users are advised to implement strict malware execution policies to mitigate risks.