Steganographic Loader Campaign Deploying Multiple Malware Families

A sophisticated steganographic campaign has been identified using phishing archives (e.g., 'GST Debit Note') to deliver a multi-stage .NET loader. The attack chain is characterized by its heavy reliance on in-memory execution and fileless techniques to evade traditional detection. The initial stage masquerades as a brick-building game, eventually extracting serialized .NET Bitmap objects containing malicious payloads.

Technical analysis indicates the campaign functions as a Loader-as-a-Service (MaaS), delivering a variety of malware including Remcos RAT, Agent Tesla, MassLogger, and Formbook. The presence of financial-themed filenames such as 'NEFT' and 'RTGS' suggests a specific focus on Indian financial operations. The ultimate objective includes credential theft from browsers, user activity monitoring, and complete remote system control.