Fileless PowerShell Loader Deploys Remcos RAT

PowerShell is becoming hackers’ new favorite tool since they can load code directly into computer memory and evade traditional file-based detection methods, warn security researchers.

See Also: A Modern Approach to Data Security

Researchers at Qualys uncovered a shellcode loader that executes the Remcos remote access Trojan. “Unconfirmed reports suggest this new sample is named ‘K-Loader,’ although no conclusive findings have been made,” the company wrote in a Thursday blog post.

The campaign starts with a phishing email with a disguised LNK shortcut as an attachment and ends with an HTML application running PowerShell scripts in memory. Attackers use mshta.exe, a Windows binary for executing Microsoft HTML Applications, files with a .hta file extension. The binary is a well-known vector for proxy execution of malicious .hta files.

Qualys’ analysis shows that the obfuscated PowerShell loader includes an anti-analysis mechanism. Its use of string obfuscation, custom decoders and in-memory execution techniques points to a growing level of sophistication.

Remcos, short for “Remote Control and Surveillance,” is a commercial RAT known for its capability to monitor user activity, log keystrokes, steal credentials and remotely control infected machines. It is frequently sold on underground forums and widely used in cybercrime operations.

“The attackers behind Remcos are evolving their tactics,” Xiaopeng Zhang said, a security researcher with Fortinet. “Instead of exploiting the CVE-2017-0199 vulnerability through malicious Excel attachments, they now use deceptive LNK files disguised with PDF icons to lure victims into executing a malicious HTA file.”

Qualys researchers found the script calls memory allocation functions such as VirtualAlloc and execution routines like CallWindowProc to inject and run Remcos directly in memory. This allows the threat actors to operate without dropping any executable to disk-effectively making the attack fileless and harder to detect.

This approach aligns with broader trends among sophisticated malware campaigns that increasingly leverage native Windows utilities and memory-resident techniques to avoid detection by endpoint security products.

The LNK-MSHTA-PowerShell combination offers a stealthy and effective path to execution, as MSHTA.exe is a trusted Microsoft binary and often allowed in enterprise environments, researchers said.