RemcosRAT Returns: Cybercriminals Use Fake SWIFT Notices in Stealthy Windows Malware Campaign
Security analysts have identified a new and highly engineered email-based attack designed to infect Windows systems with RemcosRAT, a remote access trojan (RAT) known for its stealth and control capabilities. This campaign, discovered by the Trustwave SpiderLabs team, hides its payload behind a convincingly forged payment document—a fake SWIFT transaction notice.
What appears to be a routine financial email is actually a carefully constructed trap. Victims who open the attached PDF are unknowingly stepping into a multi-layered infection chain. The PDF file contains a link to an external site:
https://huadongarmouredcable.com/pdf/default.php
—this is where the true compromise begins.
The infection process unfolds through the following stages:
- Stage One: The malicious PDF directs users to download an obfuscated JavaScript file.
- Stage Two: That JavaScript silently reaches out for a secondary payload—a second JavaScript file.
- Stage Three: The second-stage script then uses PowerShell via
ActiveXObjectto download and decode the final malware dropper—RemcosRAT.
This RAT gives attackers extensive access to compromised machines, including keystroke logging, remote desktop viewing, file access, and more.
⚠️ Key Takeaway:
This campaign exemplifies the continued evolution of phishing tactics—using seemingly legitimate financial documents to bypass user suspicion and technical defenses.
Stay alert: If you see unsolicited payment confirmations with attached PDFs, do not open or click anything. Always verify with your finance team before taking action.
Stealth in Plain Sight: Image-Based Payload Delivery Used in Latest RemcosRAT Campaign
In a sharp escalation of malware stealth tactics, threat actors have launched a new Windows-targeted attack that uses image-based payload concealment—a sophisticated twist in the delivery of RemcosRAT. Uncovered by researchers at Trustwave SpiderLabs, the operation embeds the malware within what looks like a harmless JPEG file, using steganography to hide its true purpose.
A Trojan Behind the Pixels
The infection flow culminates in a PowerShell script that retrieves a seemingly innocuous image from a public URL. Behind its surface lies a hidden payload: the Remcos Remote Access Trojan, expertly buried using data-hiding techniques. Once decoded and triggered, the malware quietly establishes communication with a remote command-and-control server, giving operators full access to the victim’s machine.
A Deceptive Start
The campaign starts with an email crafted to look like a formal banking notice. Disguised as a SWIFT payment confirmation, the message uses subject lines like “SWIFT Copy” and includes a polite sign-off to reinforce legitimacy. The attacker, posing as “Arabella Lee,” urges the recipient to review the details in the attached PDF—where the infection chain begins.
Attached metadata shows the message size to be only 525 bytes, suggesting a streamlined but deliberate social engineering tactic designed to evade filters and raise no suspicion.
Attack Infrastructure and Technical Indicators
To help defenders identify and block this threat, SpiderLabs has shared the following malicious URLs tied to the campaign:
hxxps://huadongarmouredcable.com/pdf/default.phphxxp://whiteafrica.lovestoblog.com/arquivo_8c092766561d46738b51ca112074f5d9.txthxxp://whiteafrica.lovestoblog.com/arquivo_ba000f161f624940a1b722da3c40e06b.txthxxps://archive.org/download/new_image_20250413/new_image.jpg
C2 Server:
tcp://www.rickscottflorida.com:2404
File Hashes:
3f83dc5091032487182bba6727eb9b8d2f12470db4f787de480173d34fd69d78e53f265e229d9ee93cc278d7fe1ecfb9
Filename Pattern:
Swift[0-9]{5}.js
What Makes This Different?
This isn’t your average malware dropper. The use of public infrastructure, fileless scripting, and deep obfuscation techniques—from ActiveX exploitation to PowerShell decoding—signals a new level of operational maturity. Most notably, embedding malware in a benign-looking image file hosted on Archive.org shows an intent to blend in with legitimate digital traffic and evade detection for as long as possible.
🔐 Defensive Recommendations
Security teams should:
- Deploy behavioral monitoring to detect stealthy PowerShell or ActiveX usage
- Block the identified IoCs
- Alert users about deceptive finance-themed lures
- Implement email sandboxing for attachments
- Educate employees on spotting socially engineered emails
This latest RemcosRAT variant is a stark reminder: threat actors are not only advancing technically—they’re mastering psychological tactics, too. As attackers move toward greater subtlety and evasion, defenders must evolve faster.
