Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT

A new malspam campaign exploits Google DoubleClick to distribute DesckVB RAT, a .NET-based remote access trojan.

• •Attackers use DoubleClick to bypass security tools and route victims to personalized phishing pages
• •HTML attachments trigger redirects to a malicious page with a "Download PDF" button
• •A ZIP archive deploys a loader that retrieves a .NET RAT and injects it into Microsoft-signed processes
• •DesckVB RAT patches AMSI and ETW, configures Defender exclusions, and communicates over raw TCP sockets
• •The trojan performs data extraction, command execution, and detects sandboxed environments

This summary was automatically generated by AI based on the original article and may not be fully accurate.