Executive Summary
The DesckVB RAT infection chain, identified in mid-2026, demonstrates a high level of evasion by leveraging high-reputation infrastructure like Google's DoubleClick for initial redirection. The campaign utilizes a sophisticated malspam kit that dynamically rebrands phishing lures based on the victim's email domain, fetching corporate logos at runtime to increase authenticity without hardcoding target data.
The technical execution is a five-stage process (HTML, JScript, PowerShell, .NET loader, and RAT) designed to remain almost entirely in-memory. The RAT actively blinds Windows telemetry by patching AMSI and ETW at the native API level and maintains persistence through randomized scheduled tasks and registry keys. The final payload often resides within trusted processes like InstallUtil.exe or MSBuild.exe to evade endpoint detection systems.
This threat is significant due to its extensive anti-analysis and anti-sandbox checks, which include forced system reboots if debugging tools are detected. The modular nature of the delivery chain allows operators to swap final payloads easily, making it a versatile tool for data exfiltration or subsequent ransomware deployment.