Legitimate domain as decoy: the malspam campaign that deploys DesckVB RAT with redirections and security evasion

Cybersecurity researchers have identified a malspam campaign that takes advantage of the reputation of a legitimate domain to get between the user and the attacker's infrastructure, and thus deliver a remote trojan (.NET) called DesckVB RAT. Instead of sending direct links to malicious servers, attackers start with an attached HTML file that redirects through Google's DoubleClick's click tracking system and, from there, links other redirections that incorporate the victim's email address encoded in Base64 to build a very convincing deception page. The technical and practical consequence is that many security tools implicitly trust the legitimacy of domains like DoubleClick and can give less alarm to these redirection chains.

The infection flow is designed to evade basic controls: a ZIP downloaded from the deception page contains a JavaScript charger that decompresses and runs a PowerShell script; that script download a .NET charger that acts as staging, does anti-analysis, disable or degrade security controls, establishes persistence and finally injects the RAT into Microsoft signature processes using a process holding technique. The malware also modifies the environment to blind Windows telemetry by parking AMSI and ETW at API level, configures exclusions in Microsoft Defender and uses raw TCP sockets to communicate with its command and control server. It is a complete chain designed to remain silent and persistent, with exfiltration capabilities, remote execution and additional load deployment.

Beyond mechanics, the strategic aspect is what makes this campaign dangerous: by using a legitimate redirector and a template that is automatically customised with the victim's mail and branding address, operators do not need to create hand-held onions for each target. This reduces costs and multiplies the scope of the operation, increasing the risk to organizations of any size. In addition, the use of techniques such as injection in signed processes and AMSI / ETW shielding complicates traditional detection based on signatures and static alerts.

Defensive measures should combine prevention, detection and response. On the front of the email, implement and ensure the correct configuration of the Sent authentication with SPF, DKIM and DMARC reduces the probability of spoofing; the DMARC reference guide is a good starting point at https: / / dmarg.org /. In addition, the mailways that sandbox attachments and links before delivering them add a critical layer that can block ZIP packages containing JavaScript or malicious HTA loaders.

In endpoints and networks, it is appropriate to apply white list of applications principles (AppLocker, WDAC), restriction policies for the execution of scripts (force that .vbs, .hta and .js are opened in text editors using GPO, as recommended by several response teams), and egress control with TLS inspection to detect C2 communications. Modern EDR solutions that monitor behavior - for example, APIs used for memory manipulations, Hooks about AmsiScanBuffer or ETW modifications - are crucial since techniques such as the "process holding" are detected better by behavioral anomalies than by static signatures (you can see the categorization of injection techniques at the MITRE ATT & CK base in https: / / attack.mitre.org / techniques / T1055 /).

It is also important to implement specific detections: alerts on the creation of Run / RunOnce keys, placement of executables on Start Folders, calls to APIs that park AMSI / ETW, Windows processes that load unusual code or spawn processes with PowerShell arguments encoded in Base64. Having response playbooks that include host isolation, memory capture and forensic analysis to identify stagers and C2 is essential to contain such a commitment before it thrives.

For end-users and administrators: do not open .html, .zip or executable files from unsolicited emails; check and send internal reports when there is the least suspicion; and reduce account privileges to limit what a RAT can do if it is executed. The combination of mail control, implementation policies, behavior monitoring and rapid response plans is the most effective defense for campaigns that exploit confidence in legitimate services and automate deception.

If you want to deepen how Windows-level protection from anti-malware injections and scanning works, technical documentation about AMSI and related APIs offers useful context for defence teams: https: / / learn.microsoft.com / en-us / windows / win32 / api / amsi /. Implementing these recommendations reduces the area exploited by campaigns that rely on reputed domains to hide their malicious infrastructure.