Phishing Campaign Uses Obfuscated Excel-to-HTA Chains to Deliver Remcos and AsyncRAT

Jul 3, 2026 · Original article ↗

Summary

LevelBlue SpiderLabs traced a global phishing campaign using macro-enabled Excel files, obfuscated HTA and PNG stages, and rotating infrastructure to deliver Remcos and AsyncRAT; FormBook and Lumma may also be involved.

Key points

LevelBlue SpiderLabs observed campaign activity primarily from June 10 to June 23, 2026, with hundreds of payload variations across more than a dozen countries and multiple industries.
Business-themed phishing emails carried Excel files whose VBA macros retrieved an HTA stage; recipients had to open the file and enable macros to start the chain.
The HTA stage used padding and Base64 obfuscation, WMI and PowerShell execution, and hidden process launch to retrieve subsequent payloads.
Later stages concealed executable payloads appended to PNG files; the article describes character substitution, reversal, and Base64 decoding to reconstruct them.
The analyzed activity delivered Remcos and AsyncRAT. The researchers say FormBook and Lumma may also be distributed, but do not confirm them in this campaign.
Cloudflare Workers infrastructure hosted many observed payload variations; the researchers report that one worker hostname accounted for about 90% of variations at that stage.
Operators used recurring positive-sounding HTA filenames and rotating infrastructure; the article identifies the naming pattern as a potential hunting indicator.

Article Details

Attack Vectors: Phishing emails with business-themed lures delivered malicious Excel attachments to sales, procurement, and vendor-management staff.
Opening an attachment and enabling macros triggered embedded VBA that retrieved an HTA stage from attacker-controlled infrastructure.
HTA scripts used PowerShell, JavaScript, and hidden process execution to stage and retrieve payloads, including DLLs embedded in PNG files.
The campaign used URL shorteners, padded and encoded scripts, and disposable Cloudflare Workers hosts to conceal payload delivery.
The final payloads included Remcos and AsyncRAT; the article says other malware may also have been distributed.
Defensive Notes: Use the recurring long, lowercase, concatenated positive-word HTA filenames as a hunting indicator; the article describes the naming pattern as consistent and high-fidelity.
Review suspicious Excel attachments that prompt users to enable macros, and investigate subsequent HTA, PowerShell, and PNG-based payload staging.
Monitor the reported attacker-used Cloudflare Workers hostnames and other rotating campaign infrastructure.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ffgfgjjddsgtrddhtjyfdsessxdssdfdfdfghfhg[.]duckdns[.]org`	Reported Remcos command-and-control domain, associated with port 14647.
HOSTNAME	`dawn-bush-ddd1[.]yasminanthonyy[.]workers[.]dev`	Additional Cloudflare Workers hostname observed in the campaign's payload infrastructure.
HOSTNAME	`icy-lab-0431[.]guilherme-telecomunicacoes2024[.]workers[.]dev`	Attacker-used Cloudflare Workers hostname reported as hosting campaign payloads; the article says it accounted for approximately 90% of observed variations at that stage.
HOSTNAME	`small-morning-8be0[.]fsocietyandtools[.]workers[.]dev`	Additional Cloudflare Workers hostname observed in the campaign.
IPV4	`173[.]231[.]188[.]244`	Remcos command-and-control IP address reported with port 14641.
IPV4	`192[.]227[.]219[.]79`	Remcos command-and-control IP address reported with ports 4550, 4551, and 4553.
SHA256	`0542b57b67b021f877969c900214362d62eb2ba56d0645ab4e62838c8c79733a`	SHA-256 associated in the report with a Remcos configuration and C2 infrastructure.
SHA256	`49c7b4eb6620917ee7ca796472b7af9f01ea6f7f80391ae7eb7bd8dabe0b7249`	SHA-256 of the analyzed malicious spreadsheet attachment that delivers AsyncRAT.
SHA256	`bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3`	SHA-256 associated in the report with a Remcos configuration and C2 infrastructure.
SHA256	`eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8`	SHA-256 associated in the report with a Remcos configuration and C2 infrastructure.
URL	`hxxp[:]//107[.]172[.]135[.]60/96/ibredgoodforbestthingscomingbackform.hta`	Reported URL hosting a Remcos HTA payload.
URL	`hxxp[:]//107[.]172[.]235[.]213/87/img_015059.png`	Reported URL hosting a PNG-named Remcos stager.
URL	`hxxp[:]//198[.]12[.]83[.]75/98/img_194618.png`	Reported URL hosting an AsyncRAT payload.
URL	`hxxps[:]//as[.]al/file/KBn1RC`	Observed URL used by the PowerShell payload to retrieve a subsequent campaign stage.
URL	`hxxps[:]//cuth[.]me/sse8kU`	Observed URL-shortener link used to redirect victims to an HTA payload.
URL	`hxxps[:]//masuk[.]to/FdpxBG`	Observed URL-shortener link used in the campaign's obfuscated payload delivery.