DuckDNS abused to distribute VBS/PowerShell RATs

Key Takeaways

• A new malware campaign is leveraging legitimate Windows scripting tools (VBS and PowerShell) and DuckDNS to distribute sophisticated Remote Access Trojans (RATs).
• The attack employs a multi-stage infection chain, using obfuscation and process hollowing to evade detection.
• The final payload is a powerful RAT capable of extensive data theft, including browser credentials, keystrokes, and clipboard contents.
• The malware establishes persistence and attempts to disable Microsoft Defender.
• Organizations and users must implement enhanced script execution policies, monitor for anomalous PowerShell activity, and strengthen endpoint defenses.

DuckDNS Abused to Distribute VBS/PowerShell RATs

A recently uncovered malware operation is exploiting common Windows scripting environments to deploy advanced remote access and data exfiltration tools. This campaign notably utilizes Visual Basic Script (VBS) and PowerShell, both standard components of enterprise systems, to mask malicious activity within seemingly routine operations.

The attackers have established a sophisticated, multi-layered delivery mechanism, relying on several DuckDNS hosts. This distributed infrastructure provides multiple points for delivering the initial infection or supporting subsequent stages of the attack against unsuspecting targets. Once a victim executes the initial script, the infection progresses from a small, inconspicuous launcher to a fully functional, 64-bit payload designed for covert operation.

The initial use of native Windows features makes these attacks particularly insidious, as they can bypass basic security checks and appear legitimate to users or less rigorous defense systems. Close scrutiny of system behavior is essential to identify and mitigate such threats.

Multi-Stage Infection Chain and Evasion Techniques

Threat researcher Anurag, who identified this activity, highlighted that two observed VBS files were structurally identical. Anurag said in a report shared with Cyber Security News (CSN) that these scripts are designed to decrypt an encrypted PowerShell stage, which in turn prepares the final remote access tool for deployment. The danger extends beyond simple credential theft, as the RAT is equipped to harvest browser data, log keystrokes, capture clipboard content, and attempt to weaken built-in security protections.

This comprehensive suite of capabilities provides attackers with a direct pathway to sensitive personal accounts, corporate services, and any confidential information processed or pasted during daily work. The initial VBS stage is heavily obfuscated, a deliberate tactic to complicate rapid analysis and detection. Upon execution, it decrypts a PowerShell component protected with AES-256 encryption. This next stage then extracts an x64 payload and uses a .NET helper to inject malicious code into a legitimate process, specifically AppLaunch.exe.

This technique, known as process hollowing, allows the attackers to execute their code within a seemingly benign process, further aiding evasion. For more details on this method, readers can consult this process hollowing attack overview. The use of multiple DuckDNS addresses complicates blocking efforts, requiring defenders to identify and neutralize every known delivery and command-and-control point. The campaign also demonstrates resilience, capable of reaching its hosts via direct IP addresses if a domain becomes compromised or blocked.

The final payload is engineered for persistence, embedding itself in the Windows Startup folder under a deceptive name like “WindowsDefender.exe.” It also attempts to create exclusions within Microsoft Defender, aiming to reduce its chances of detection. This echoes the sophisticated nature of other PowerShell backdoor malware attacks, emphasizing why script-based threats demand significant attention, even if their initial footprint appears minimal. The activity was first documented by Anurag on August 9, 2026.

Credential Theft and Defensive Steps

The RAT’s ability to steal browser credentials and cookies is highly valuable to attackers, granting them unauthorized access to email accounts, business portals, and various other online services without needing to crack passwords directly. The inclusion of keystroke logging and clipboard content capture further amplifies this risk, potentially exposing passwords, one-time verification codes, private messages, or payment details as they are typed or copied.

The keylogger component reportedly stores collected data locally before exfiltrating it. The malware also establishes command-and-control (C2) communications over port 4577. This combination of data collection, persistence mechanisms, and remote communication transforms an initial script execution into a significant account compromise and privacy breach.

What You Should Do

• Block Indicators of Compromise (IoCs): Immediately implement the provided SHA-256 hashes, domain names, and IP addresses in your firewalls, DNS filters, and security information and event management (SIEM) systems.
  • VBS SHA-256: 8c78a55c8bf545e0d21b8757eaa0b709b4af47b13d34a38df81045e67026bd96
  • Observed VBS File Names: envifa.vbs, sostener2.vbs
  • Final Payload SHA-256: 7a3c619827557de9a3687daa137f772f40e1bba1a4ca32bac1b06557f42ce522
  • Process-Hollowing Helper SHA-256: 1932a80706489d55ae779ad1edfe0d0beb0239d0fc7bb10f99f89bc804ad3407
  • DuckDNS Hosts: serversniperxx[.]duckdns[.]org, asegurar2026nuevo[.]duckdns[.]org, asegurar2026[.]duckdns[.]org, 2seguro2025[.]duckdns[.]org, www[.]2seguro2025[.]duckdns[.]org
  • IP Address: 181.237.42[.]61
  • Likely C2: serversniperxx[.]duckdns[.]org:4577
  • Persistence Path: %APPDATA%MicrosoftWindowsStart MenuProgramsStartupWindowsDefender.exe
  • Keylogger Storage: C:ProgramDataSniperLogs
• Enhance Endpoint Monitoring: Actively hunt for evidence of these IoCs across all endpoints. Pay particular attention to unusual PowerShell activity, especially encoded or hidden scripts, and any unexpected child processes originating from script execution.
• Restrict Script Execution: Limit the execution of VBS and PowerShell scripts in environments where they are not explicitly required for legitimate business functions. Implement stringent script execution policies.
• Educate Users: Advise users against opening unexpected script files, even if they arrive in archives or appear to be routine documents. Emphasize vigilance against phishing attempts.
• Monitor Defender Exclusions: Promptly investigate any unauthorized or unexpected changes to Microsoft Defender exclusions.
• Implement Multi-Factor Authentication (MFA): Utilize MFA for all critical accounts to provide an additional layer of security against stolen credentials.
• Incident Response: If a system matches any IoC, immediately isolate it from the network. Conduct a thorough forensic investigation to determine the extent of compromise. Resetting passwords may not be sufficient; review and invalidate all affected account sessions if browser cookies or active sessions were compromised.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.