Executive Summary
Recent activity highlights a renewed reliance on AutoIT-based infection chains to deliver credential-stealing malware and remote access tools. The attack begins with phishing emails containing RAR archives that trigger a complex multi-stage execution flow involving VBScript, PowerShell, and AutoIT interpreters.
The technical chain involves multi-layered obfuscation, including Base64 encoding, Gzip compression, and XOR operations to mask malicious files. The final AutoIT stage utilizes Windows API calls to perform process injection, typically targeting charmap.exe to host the final payload, identified as VIPKeylogger or MedusaHVNC.
This campaign poses a significant risk to organizations due to the use of legitimate system utilities for persistence and execution, potentially bypassing basic security controls. The primary impact involves credential theft and unauthorized remote access via hidden desktops, targeting sectors like financial services through fake bank-themed lures.