Q3 2025 saw a surge in email campaigns using obfuscated JavaScript attachments that act as downloaders to deliver .NET-based information stealers and RATs such as DarkCloud, Remcos, Agent Tesla and Formbook via PowerShell and steganography. Attack chains include ZIP/RAR attachments, base64-embedded payloads in PNG/TXT files, VM/sandbox evasion and process hollowing to exfiltrate data to dynamic DNS, FTP/SMTP, and Google Drive links. #DarkCloud #Remcos #AgentTesla #Formbook
Keypoints
- Attackers are using localized, business-themed lures (quotes, invoices, shipment alerts) to increase user trust and evade filters.
- Initial payloads are obfuscated JavaScript files packaged in archives (ZIP, RAR, 7z, TAR) that act as downloaders for secondary stages.
- PowerShell is used to fetch next-stage payloads, including PNG and TXT files that contain Base64-encoded PE binaries via steganography.
- Final payloads are primarily .NET DLLs protected with .NET Reactor, employing obfuscation, randomized symbols, and anti-analysis measures.
- Techniques observed include VM/sandbox detection, process hollowing targeting RegASM.exe, and use of Windows APIs to inject and resume malicious code.
- Exfiltration or callbacks are performed via dynamic DNS domains, FTP/SMTP mail actions, and cloud storage (Google Drive) links.
- Forcepoint protections are asserted at multiple stages: blocking malicious JavaScript attachments, adding droppers to malicious DBs, and categorizing C2 domains.
MITRE Techniques
- [T1204] User Execution – Malicious JavaScript attachments are delivered in archive files and rely on recipients opening attachments: “JS files…obfuscated and packed inside ZIP attachments that act as downloaders.”
- [T1059.001] Command and Scripting Interpreter: PowerShell – Obfuscated JavaScript constructs and executes PowerShell commands to download next-stage payloads: “PowerShell commands are visible which downloads the next stage payload from a compromised domain.”
- [T1105] Ingress Tool Transfer – Downloading payloads from remote hosts including compromised domains and cloud storage: “PowerShell tries to connect and download next stage stenography payload (.png file) from hxxps://educa[.]rr[.]gov[.]br/… and .TXT from hxxp://motorshipco[.]rf[.]gd/arquivo_… .”
- [T1056.001] Input Capture: Keylogging/Clipboard – Toolset includes clipboard hijackers and credential stealers delivered by the chain: “they pull down and run credential stealers, remote-access tools and clipboard hijackers.”
- [T1027] Obfuscated Files or Information – Heavy obfuscation of JavaScript, Unicode markers, and packed .NET assemblies to evade analysis: “script is heavily obfuscated, storing many string fragments…strips out the marker characters with ‘.replace(//g,””)’.”
- [T1140] Deobfuscate/Decode Files or Information – Base64-encoded payloads embedded inside PNG and TXT files are extracted and decoded to produce PE binaries: “Downloaded PNG file contains a payload encoded in Base64…delimited by ‘BaseStart-‘ and ‘-BaseEnd’.”
- [T1497.001] Virtualization/Sandbox Evasion: System Checks – VM and sandbox detection via enumerating processes and control-flow checks to avoid analysis: “invoke Process.GetProcesses()…part of a VM/sandbox detection mechanism.”
- [T1094] Proxy/Indirect Command Execution: Windows Management Instrumentation (WMI) – JavaScript/PowerShell uses WMI to start commands as hidden processes (.ShowWindow = 0): “uses Windows WMI interface to start that command as a hidden process (.ShowWindow = 0).”
- [T1055.012] Process Hollowing – Sequence of API calls (CreateProcess, VirtualAllocEx, WriteProcessMemory, ZwUnmapViewOfSection, Get/SetThreadContext, ResumeThread) used to hollow RegASM.exe and run malicious code: “process hollowing will happen which targets to RegASM.exe process…API calls: CreateProcess — … VirtualAllocEx — … WriteProcessMemory — … ResumeThread — …”
- [T1041] Exfiltration Over C2 Channel (Email/FTP/Dynamic DNS) – Use of EmailAction, SMTP/FTP obfuscated calls, dynamic DNS and cloud services to exfiltrate data or communicate with C2: “EmailAction object…prepare and send email possible data exfiltration…dynamic DNS servers or SMTP / FTP email client.”
Indicators of Compromise
- [URLs] Download/staging hosts – hxxps://educa[.]rr[.]gov[.]br/resources/img/1[.]png, hxxp://motorshipco[.]rf[.]gd/arquivo_20250917185017[.]txt
- [URLs] Additional payload/drop locations – hxxps://files[.]catbox[.]moe/91noox[.]zip, hxxps://files[.]catbox[.]moe/i5wcp9[.]zip
- [Cloud Links] Cloud storage used for hosting payloads – Google Drive download URLs (export=download&id=1aSe3u…, export=download&id=1y-UcT…)
- [Domains/IPs] C2 / compromised infrastructure – tooblessed2bcursed[.]duckdns[.]org, 196[.]251[.]92[.]42, 198[.]55[.]98[.]29
- [Compromised Emails] Abused sender addresses – service[.]bluete@lindenapotheke-mhl[.]de, service@rainer-will-hs[.]de
- [File Names] Staged files and markers – arquivo_20250917185017[.]txt, optimized_MSI[.]png, and Base64-embedded stream delimited by “BaseStart-” and “-BaseEnd”
Read more: https://www.forcepoint.com/blog/x-labs/q3-2025-threat-brief-obfuscated-javascript-steganography