Hackers Spread VIP Keylogger via Fake Business Emails

Hackers are actively deploying VIP Keylogger through phishing emails disguised as routine business documents, using multi‑layered loaders, steganography, and in‑memory execution to quietly steal credentials and other sensitive data from compromised systems.

Recent VIP Keylogger campaigns rely heavily on social engineering, with phishing emails crafted to look like legitimate bank payment notifications, procurement orders, logistics updates, or other financial and operations‑related messages.

The attachments are typically script‑based loaders or archives masquerading as business documents, encouraging users to open them under the guise of invoices, payment confirmations, or internal approvals.

STRT analyzed more than 200 VIP script loader samples collected between March and April 2026, noting consistent naming patterns aligned with financial workflows to improve the chances of user interaction.

These naming conventions, observed via services like VirusTotal, help attackers blend into normal business traffic, reducing suspicion at both the user and email gateway levels.

The VIP Keylogger infection chain is driven by three primary script loader families: VBScript (.vbs), JavaScript (.js), and batch files (.bat), all heavily obfuscated to evade static analysis and security tooling.

The malicious VBScript variant pads the file with large sections of junk code at the beginning and end, hiding the real payload in the middle and decoding a long hex‑encoded string into a PowerShell stager when executed.

This PowerShell stager then writes its decoded script into a user environment variable (for example, INTERNAL_DB_CACHE), executes it, and removes it, minimizing filesystem artifacts while still leaving a detectable footprint in the HKCU\Environment registry hive.

Splunk Threat Research Team (STRT) said in a report shared with GBhackers, shows how this infostealer combines common phishing lures with evasive scripting techniques to bypass traditional defenses and remain difficult to detect in enterprise environments.

JavaScript‑based loaders follow a similar pattern, using deep obfuscation to hide code that ultimately spawns PowerShell, where subsequent stages perform decryption and in‑memory loading of the final payload.

Hackers Spread VIP Keylogger

A key evasion technique observed by STRT is the use of steganography to hide malicious components inside PNG images downloaded during the infection chain.

The PowerShell stager retrieves image files from attacker‑controlled infrastructure, where the first PNG contains an encoded downloader and the second PNG embeds the final VIP Keylogger payload in an obfuscated format.

The decoding routine searches for specific markers within the embedded data, replaces characters that disguise base64 patterns, reverses the string, and then base64‑decodes it to reconstruct the executable content in memory.

This approach allows attackers to move the most sensitive stages of the malware into memory without ever dropping a conventional executable to disk, significantly complicating detection by signature‑based tools.

Once decoded, VIP Keylogger relies on staged PowerShell to decrypt multiple PE modules and inject the final payload into legitimate .NET utilities such as aspnet_compiler.exe using reflective loading techniques.

The first is a .NET module designed to inject the second executable, the VIP Keylogger, into a legitimate aspnet_compiler.exe process using “Invoke-AssemblyExecution” Function. 

Running inside a trusted Windows process enables the stealer to blend in with normal activity, bypassing simplistic allow‑lists that treat signed Microsoft binaries as inherently safe.

For persistence, one common loader variant hides a PowerShell stager inside a batch file and then writes the decoded script to user‑writable locations like %AppData%\Microsoft\Windows\Libraries, before configuring the UserInitMprLogonScript registry key so that the malware is executed at every user logon.

This ensures that VIP Keylogger remains active across reboots and continues exfiltrating data over time unless detected and removed.

Once active on a host, VIP Keylogger behaves as a full‑featured infostealer, collecting keystrokes, browser‑stored credentials, cookies, autofill data, clipboard content, Wi‑Fi profiles, and screenshots to maximize the value of stolen information for attackers.

The malware targets Chromium‑based browsers, Firefox‑family products, and applications like Discord, abusing their local storage and database structures to harvest credentials and session tokens at scale.

To evade analysis, the malware performs environment checks, including IP reputation lookups and hostname comparisons, to detect sandboxes or automated analysis environments, and it can self‑delete or alter execution if suspicious artifacts are found.

It then exfiltrates stolen data to multiple command‑and‑control endpoints, including Telegram bots and dedicated C2 servers, leveraging standard web protocols to blend in with normal outbound traffic.

STRT’s research maps VIP Keylogger behaviors to MITRE ATT&CK and provides several Splunk analytics to help defenders hunt for this activity in their environments.

High‑value telemetry includes monitoring registry changes under HKCU\Environment for anomalously long values or the UserInitMprLogonScript key, script‑based spawning of .NET utilities from unusual directories, and PowerShell ScriptBlock logs combining environment variable operations with dynamic code execution.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.