Watch out, that Excel document could be infected with dangerous malware


  • A new phishing campaign was recently spotted, distributing an Excel file
  • The file drops a fileless version of the Remcos RAT on the device
  • Remcos can steal sensitive files, log keys, and more

Hackers have been seen distributing a fileless version of the Remcos Remote Access Trojan (RAT), which they then use to steal sensitive information from the target devices using hijacked spreadsheet software.

In a technical analysis, researchers from Fortinet said they observed threat actors sending out phishing emails with the usual purchase order theme. Attached with the email is a Microsoft Excel file, built to exploit a remote code execution vulnerability found in Office (CVE-2017-0199). When triggered, the file will download an HTML Application (HTA) file from a remote server, and launch it via mshta.exe.

The downloaded file will pull a second payload from the same server, which will run the initial anti-analysis and anti-debugging, after which it will download and run Remcos RAT.

Remcos returns

For its part, Remcos was not always considered malware. It was built as a legitimate, commercial software, used for remote administration tasks. However, it was hijacked by cybercriminals, in the same way Cobalt Strike was hijacked, and is nowadays mostly used for unauthorized access, data theft, and espionage. Remcos can log keystrokes, capture screenshots, and execute commands on infected systems.

But this version of Remcos gets dropped directly into the device’s memory: “Rather than saving the Remcos file into a local file and running it, it directly deploys Remcos in the current process’s memory,” Fortinet explained. “In other words, it is a fileless variant of Remcos.”

Phishing via email continues to be one of the most popular ways cybercriminals infect devices with malware, and steal sensitive information. It is cheap to execute, and performs well, making it a highly efficient attack vector. The best way to defend against phishing is to use common sense when reading emails, and to be extra wary when downloading and running any attachments.

Related posts

FBI confirms Chinese hackers accessed US government official devices, networks

Amazon unveils all-new Fire TV products, including an Omni mini-LED TV to take aim at Hisense and TCL, plus a Dolby Atmos soundbar

There’s now one less reason to visit the Microsoft Store – free Instant Games have been scrapped (though they didn’t help the platform much anyway)

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Read More