A trojanized CPUID HWMonitor installer was used to deliver a multi-stage, fileless malware chain that leverages trusted Windows binaries (PowerShell, MSBuild, regsvr32) to execute scriptlet payloads such as Clippy.sct which reconstructs and runs a .NET assembly entirely in memory. The reconstructed payload is deserialized and dynamically invoked (with likely follow-on shellcode execution via VirtualAlloc/CreateThread), and organizations are advised to validate installers, deploy EDR, and monitor for regsvr32/MSBuild/scriptlet usage and large embedded arrays. #HWMonitor #Clippy.sct

The article analyzes how threat actors abuse the Microsoft-signed MSBuild.exe to run inline C# project files and perform fileless operations such as reverse shells, downloading payloads, and DLL sideloading to evade detection. It reviews proof-of-concept and real-world campaigns demonstrating Windows Defender bypasses via automatic project-file execution and recommends behavior-based, multi-layered detection...

ReliaQuest observed a fileless campaign called DeepLoad that uses ClickFix social engineering to execute an obfuscated PowerShell loader, compile an in-memory injector, and perform APC process injection into trusted processes like LockAppHost.exe while immediately stealing credentials. The campaign achieves persistence via scheduled tasks, USB propagation, and hidden WMI event subscriptions that allowed reinfection days after apparent cleanup, so defenders should enable PowerShell Script Block Logging, audit WMI subscriptions, and rotate exposed credentials. #DeepLoad #ClickFix

A targeted, multi‑stage campaign delivers PureLog Stealer using localized phishing lures and an evasive, encrypted delivery chain that extracts and executes payloads entirely in memory. The attack employs fileless techniques including a Python loader, dual .NET loaders, AMSI bypass, remote key retrieval, and C2 exfiltration, impacting organizations running Windows in healthcare,...