VIP Keylogger Delivered via Phishing Targets Businesses

Key Takeaways

• The VIP Keylogger malware is being actively distributed through sophisticated phishing campaigns targeting businesses.
• Attackers leverage highly obfuscated script loaders and steganography to evade detection and deliver the keylogger.
• Once installed, VIP Keylogger extensively harvests sensitive data, including keystrokes, screenshots, passwords, and cryptocurrency wallet information.
• The malware employs advanced evasion techniques, including hiding in legitimate Windows processes and self-deletion.

Cybercriminals are currently deploying a potent information-stealing malware known as VIP Keylogger through meticulously crafted phishing emails. These deceptive communications are designed to mimic routine business correspondence, aiming to trick recipients into initiating the infection chain.

This campaign has been observed for several months, with threat actors showing no signs of abatement. VIP Keylogger represents a significant component of the broader trend of infostealer malware, which has become a dominant force in the contemporary threat landscape. These tools are engineered for rapid and surreptitious data exfiltration, either as standalone threats or as precursors to more destructive follow-on attacks.

What distinguishes VIP Keylogger is its robust resilience and the multi-layered evasion tactics employed by its operators throughout the entire infection lifecycle.

Researchers from the Splunk Threat Research Team (STRT) recently published a comprehensive analysis of the malware, highlighting the heavy reliance on social engineering in recent VIP Keylogger campaigns. In a report shared with Cyber Security News (CSN), STRT noted that attackers are disguising malicious files as legitimate documents such such as bank payment notifications, procurement orders, and logistics updates to entice targets into opening them.

Upon a user opening the malicious file, a complex, multi-stage infection process is triggered, ultimately embedding the keylogger deep within the system. This process is engineered to remain covert at every step, ensuring that by the time the final payload becomes active, the malware has already integrated itself into a legitimate Windows process, making detection exceedingly difficult.

STRT’s analysis encompassed over 200 VIP script loader samples collected between March and April 2026, utilizing data from VirusTotal to scrutinize the attackers’ naming conventions and delivery methods. This research offers critical insights into one of the most persistent malware families currently targeting Windows users globally.

Phishing Emails Deliver VIP Keylogger Through Layered Script Loaders

The initial compromise typically begins with one of three script file types: a Visual Basic Script (.vbs), a JavaScript file (.js), or a batch script (.bat). Each of these initial loaders is heavily obfuscated using various techniques, including junk code padding, hex encoding, and AES-encrypted PowerShell stagers, all designed to bypass security defenses.

For instance, the .vbs loader conceals its malicious payload within the file, embedded between large segments of irrelevant code. Once decoded, it transitions execution to a PowerShell stager, which is written to a hidden environment variable named INTERNAL_DB_CACHE before being run. While stealthy, this method leaves a detectable trace in the Windows registry that can be monitored by security teams.

A particularly innovative tactic employed by VIP Keylogger operators is steganography, where malicious code is hidden within seemingly innocuous image files. The PowerShell stager downloads two .png files from a remote server, with each image secretly containing encoded components of the ultimate payload. Only after these images are successfully decoded does the actual keylogger emerge and proceed to inject itself into a legitimate Windows process, specifically aspnet_compiler.exe.

VIP Keylogger Capabilities and How to Detect It

Once successfully installed, VIP Keylogger poses a severe threat to any user of the compromised machine. Its extensive capabilities include capturing every keystroke, taking periodic screenshots of the desktop, exfiltrating saved passwords and cookies from numerous popular browsers, and scanning the Windows registry for Outlook credentials. Furthermore, it actively monitors clipboard content in real-time, surreptitiously replacing any copied cryptocurrency wallet addresses with those controlled by the attacker.

The malware communicates with multiple command-and-control (C2) servers to transmit stolen data, including through a Telegram bot. It also performs checks against the victim’s IP address to identify and avoid known sandbox environments, and self-deletes from disk after execution to erase its tracks.

STRT recommends several detection strategies for security teams. These include monitoring registry changes associated with the UserInitMprLogonScript key, flagging PowerShell scripts that combine environment variables with dynamic execution commands, and observing for unusual processes launched from script-based parent processes. Additionally, security personnel should watch for DNS queries directed at Telegram’s API domain, which can be an indicator of active malware-driven data exfiltration.

What You Should Do

• Implement Robust Email Security: Deploy advanced email filtering solutions capable of detecting and blocking phishing attempts, malicious attachments, and suspicious links.
• Employee Training: Conduct regular cybersecurity awareness training for all staff, focusing on identifying sophisticated phishing emails, recognizing suspicious attachments, and understanding the risks of opening unsolicited files.
• Patch Management: Ensure all operating systems, applications, and security software are kept up-to-date with the latest patches to mitigate known vulnerabilities.
• Enable PowerShell Script Block Logging: Activate PowerShell script block logging to gain deeper visibility into script execution and aid in detecting obfuscated malicious scripts.
• Monitor for IoCs: Implement monitoring for the provided Indicators of Compromise (IoCs) within your SIEM, EDR, and network security tools. This includes file hashes, suspicious URLs, and DNS queries to known C2 domains like api.telegram[.]org.
• Registry Monitoring: Actively monitor changes to critical Windows registry keys, such as UserInitMprLogonScript, for unauthorized modifications.
• Network Traffic Analysis: Monitor outbound network traffic for unusual connections, especially to uncommon domains or IP addresses, and look for DNS queries to Telegram’s API domain.
• Endpoint Detection and Response (EDR): Utilize EDR solutions to detect and respond to suspicious process activity, unusual PowerShell execution patterns, and file injection attempts into legitimate processes.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.