Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT
A new malspam campaign is leveraging Google's DoubleClick domain to deliver the DesckVB RAT, a .NET-based remote access trojan. The campaign’s scalability and cost-effectiveness stem from its ability to dynamically personalize lures and eliminate the need for bespoke kits. This attack highlights the importance of layered security defenses to mitigate such threats.
The campaign begins with a phishing email containing an HTML attachment. Opening this attachment triggers a redirect through DoubleClick, leading the victim to a personalized landing page designed to mimic legitimate business communications. This personalized approach, utilizing the victim's email address and company branding, significantly increases the likelihood of the user falling for the lure. The final stage involves downloading a ZIP archive containing a JavaScript loader that executes a .NET RAT, utilizing techniques like process hollowing to evade detection and security controls.
Once active, the DesckVB RAT performs reconnaissance, configures Defender exclusions, and attempts to disable telemetry. The attackers employ tactics such as patching AMSI and ETW to further obscure their activity. The malware establishes persistence through registry entries and Startup folder placement, aiming for long-term control of the compromised system. The campaign’s sophistication includes mechanisms to detect analysis tools and sandboxed environments, allowing the malware to terminate itself and reboot the system to avoid detection.
Security researchers emphasize the need for robust defense-in-depth strategies. Recommendations include utilizing Group Policy Objects (GPOs) to restrict the execution of potentially malicious scripts and implementing email security measures like DMARC, DKIM, and SPF records, alongside sandboxing attachments and links.