A sophisticated new threat has surfaced in the wild, identified as the DesckVB RAT version 2.9. This modular Remote Access Trojan, built on the .NET framework, has been observed in active malware campaigns throughout early 2026. Unlike simple backdoors, this threat demonstrates a high level of operational maturity, designed to establish persistent control over compromised systems while evading traditional defense mechanisms. The malware initiates its attack through a highly obfuscated Windows Script Host (WSH) JavaScript file. This initial stager performs critical setup tasks, such as copying itself to public user directories and executing via the wscript engine to mask its activity. By leveraging native Windows components, the attackers can blend their malicious traffic with legitimate system processes, complicating detection efforts for security teams. GitHub analysts noted that this initial activity is merely a gateway, setting the stage for a more potent payload. Following the initial execution, the infection chain transitions into a PowerShell stage that performs rigorous anti-analysis checks. It verifies internet connectivity and scans for debugging tools, ensuring the environment is safe before downloading the core malicious components. This careful validation prevents the malware from executing in sandboxes . The impact of DesckVB RAT lies in its stability and stealth. By using a fileless .NET loader, the malware executes directly in memory without leaving a physical footprint on the disk. This “living off the land” approach allows it to bypass many static file scanning defenses, making forensic analysis significantly more challenging for incident responders. Modular Plugin Ecosystem The most defining feature of DesckVB RAT is its robust plugin-based architecture, which allows operators to extend capabilities dynamically. Instead of bundling every malicious function into a single executable, the attackers can selectively deploy specific modules post-compromise based on the target’s value. Validated plugins include a comprehensive keylogger that tracks active windows, a webcam streamer using DirectShow, and an antivirus enumerator that reports installed security products. These modules are delivered via a custom TCP protocol that uses distinct delimiters to manage payloads. This flexibility transforms the RAT from a simple backdoor into a versatile espionage tool, capable of adapting to various operational needs without requiring a complete re-infection of the host system. Security professionals are advised to focus on behavioral detection to mitigate this threat. Monitoring for unusual wscript.exe execution and PowerShell scripts building decimal byte arrays can provide early warning signs. Ensuring that endpoint detection systems are tuned to spot reflective code loading is also essential for effective mitigation against these evolving attacks. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post New DesckVB RAT with Multi-stage Infection Chain and Plugin-Based Architecture appeared first on Cyber Security News .

Daily Recap, CISA and vendors warned of active exploitation and available proof-of-concept code tied to multiple high-risk issues, including Magento, Cisco Unified CM, and VS Code token theft, plus Android/Linux bugs, while a new HTTP/2 Bomb DoS technique can crash servers in under a minute. The day also covered rapid China-linked criminal activity using Atlas RAT, malspam abusing Google DoubleClick to deliver DesckVB RAT, Gemini prompt-injection risk via WhatsApp/Slack notifications, and further enforcement and policy updates involving Nobitex, fuel-tank monitoring targeting warnings, and CISA staffing planning. #CISA #Magento #CiscoUnifiedCM #Vscode #GoogleDoubleClick #AtlasRAT #DesckVBRAT #WhatsApp #Slack #GoogleGemini #HTTP2Bomb #Nobitex

DoubleClick redirects hide DesckVB RAT malspam, using dynamic lures and .NET loaders to evade detection and control hosts.

Researchers uncovered a malspam campaign that abuses Google's DoubleClick domain to hide its redirect chain and deliver DesckVB RAT through a phishing email attachment. The attack uses dynamic victim personalization, multiple loaders, and defense evasion techniques to gain persistence, disable security tools, and take control of infected systems. #DoubleClick #DesckVBRAT...

A new Remote Access Trojan known as DesckVB has been targeting systems in 2026, using obfuscated JavaScript and a fileless .NET loader to stay hidden from traditional security tools. The malware gives attackers full remote control over a victim’s machine, making it a serious threat for individuals and organizations alike. DesckVB RAT starts its infection chain with a heavily obfuscated JavaScript file that, once executed, silently drops a PowerShell script into the  C:\Users\Public  directory on the target system. The JavaScript replicates its code into PowerShell and text files, giving the malware multiple ways to run. What makes this threat particularly dangerous is that it avoids writing most of its core components to disk, making it much harder for conventional antivirus tools to catch it. Point Wild analysts from the LAT61 Threat Intelligence Team identified and examined DesckVB RAT in detail, uncovering how it uses layered obfuscation to hide its true purpose at every stage of execution. Their research found that the malware combines Base64 encoding with URL string reversal to conceal its command-and-control (C2) server addresses, a tactic designed to trick automated scanning tools. The overall structure of the malware suggests it was built with a clear understanding of how modern security defenses work. Once fully deployed, DesckVB RAT loads a .NET assembly directly into memory using .NET reflection techniques, bypassing the need to leave any files on the hard drive. This in-memory execution method allows the malware to run its harmful routines without triggering many standard file-based detection systems. At runtime, the malware activates several harmful capabilities, including keylogging, webcam access, antivirus detection evasion, and encrypted communication with its C2 server. The overall impact of DesckVB RAT is broad and concerning. Attackers who deploy it can steal sensitive information, monitor user activity in real time, and maintain long-term access to a compromised system without raising immediate alarms. Its use of encrypted HTTPS traffic over port 443 allows it to blend in with normal internet activity, making network-level detection just as difficult. The Fileless Infection Chain The most notable aspect of DesckVB RAT is how it moves through its infection stages without relying on traditional file drops. The malware’s flow begins with the JavaScript file, acting as the first entry point. Shows flow of malware (Source – Point Wild) This file is heavily obfuscated and drops a PowerShell file directly into  C:\Users\Public , keeping its activities within commonly overlooked system folders. JS obfuscated file (Source – Point Wild) The PowerShell script first checks for internet connectivity by pinging Google, then attempts to connect to a malicious external domain. The C2 domain is hidden using Base64 encoding combined with string reversal. The malware uses the legitimate Windows tool  InstallUtil.exe  to execute its payload — a known technique for bypassing application control policies. From there, the script loads  ClassLibrary3.dll  directly into memory and invokes the obfuscated method  prFVI , which then loads  ClassLibrary1.dll . The Execute method within this loader uses  CreateProcessA  to spawn a new process in a suspended state before injecting the malicious payload. Obfuscated method (Source – Point Wild) This process injection approach allows the malware to hide inside trusted processes and avoid drawing attention. Encoded String Array (Source – Point Wild) The final payload,  Microsoft.exe , carries encoded string arrays that hold a hidden runtime configuration. Once active, it drops  Keylogger.dll  directly into memory and begins C2 communication over  manikandan83.mysynology.net  on port  7535 , resolving to IP  45.156.87.226 . Network captures confirm the malware transmits its module names and internal activity to its remote server. Security teams should watch for unusual PowerShell execution, unexpected use of  InstallUtil.exe , and outbound connections to unknown domains or IPs. Blocking script execution from  C:\Users\Public  and enabling detailed PowerShell script logging are practical first steps to catching this threat early. Keeping endpoint protection software current also remains a critical defense, as detection tools have already shown the ability to flag key components of this malware. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post DesckVB RAT Uses Obfuscated JavaScript and Fileless .NET Loader to Evade Detection appeared first on Cyber Security News .

Cybersecurity researchers have flagged a new malspam campaign that makes use of Google's DoubleClick domain as a way to evade detection and ultimately deliver a remote access trojan (RAT) named DesckVB RAT. "Before the victim ever reaches attacker-controlled infrastructure, the lure routes through DoubleClick, a legitimate Google-owned domain that many security tools are less likely to treat as

Introduction Cybercriminals continue to refine their tactics, leveraging trusted online advertising and tracking infrastructures to bypass traditional security defenses. A newly observed phishing campaign demonstrates how attackers are abusing Google DoubleClick redirect mechanisms to conceal malicious destinations and ultimately deliver the DesckVB Remote Access Trojan (RAT) to unsuspecting victims. By combining personalized email lures, HTML attachments, PowerShell-based malware loaders, and multiple layers of defense evasion, threat actors are creating an attack chain that is significantly harder to detect than conventional phishing operations.

Introduction: Cybercriminals have devised a sophisticated new malspam campaign that exploits Google’s legitimate DoubleClick ad-tracking domain to bypass security filters and deliver a powerful remote access trojan (RAT). By routing victims through a trusted Google domain, attackers significantly lower the likelihood of detection before deploying the fileless .NET-based DesckVB RAT, which grants them full control over compromised machines. This incident highlights the escalating trend of abusing trusted, reputable services to evade traditional security measures and the critical importance of a defense-in-depth strategy.

Curate Feeds | Make Collections | Customize Email Briefs

Professional services firms are being targeted with a .NET loader disguised as purchase orders. The attack chains through Google's DoubleClick to bypass email filters, then profiles victims before deploying additional payloads. #infosec #cybersecurity

Cybersecurity researchers have flagged a new malspam campaign that makes use of Google's DoubleClick domain as a way to evade detection and ultimately deliver a remote access trojan (RAT) named DesckVB RAT. "Before the victim ever reaches attacker-controlled infrastructure, the lure routes through DoubleClick, a legitimate Google-owned domain that many security tools are less likely to treat as

DoubleClick redirects hide DesckVB RAT malspam, using dynamic lures and .NET loaders to evade detection and control hosts.

Ravie LakshmananJun 03, 2026Malware / Microsoft Defender

DoubleClick redirects hide DesckVB RAT malspam, using dynamic lures and .NET loaders to evade detection and control hosts.

DesckVB RAT is a remote access trojan that uses layered scripting, fileless loading, and process injection to avoid many traditional defenses. Point Wild’s LAT61 team says the malware starts with an obfuscated JavaScript file, drops a PowerShell stage, and then loads .NET components directly into memory instead of relying on obvious files on disk. The […] The post DesckVB RAT uses obfuscated JavaScript and a fileless .NET loader to evade detection appeared first on VPN Central.