DEAD#VAX AsyncRAT Campaign — IPFS-Hosted VHD Phishing, 5-Stage Fileless Infection Chain, Mark-of-the-Web Bypass, Self-Parsing Batch Scripts, 4-Layer PowerShell Deobfuscation, In-Memory Shellcode Injection into Trusted Processes — Threadlinqs Intelligence
As of 2026-05-30, DEAD#VAX AsyncRAT Campaign — IPFS-Hosted VHD Phishing, 5-Stage Fileless Infection Chain, Mark-of-the-Web Bypass, Self-Parsing Batch Scripts, 4-Layer PowerShell Deobfuscation, In-Memory Shellcode Injection into Trusted Processes is a high-severity phishing threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0092 · Severity: HIGH · Status: MONITORING · Category: PHISHING
Attribution: N/A · FINANCIAL
DEAD#VAX is a sophisticated multi-stage malware campaign tracked by Securonix Threat Research that delivers AsyncRAT via IPFS-hosted VHD phishing lures. The attack chain progresses through VHD
DEAD#VAX is a multi-stage, fileless malware campaign documented by Securonix Threat Research (researchers Akshay Gaikwad, Shikha Sangwan, Aaron Beardslee, published January 14, 2026, advisory published February 4, 2026). The campaign delivers AsyncRAT through an elaborate 5-stage infection chain designed to evade traditional security controls at every step.
**Stage 1 — Initial Access (Phishing + IPFS-hosted VHD):** The attack begins with spear-phishing emails impersonating Progressive Components (procoms.com), a legitimate tooling supplier. The actual sending domain is mingyitc.com (likely compromised). The email creates artificial urgency with a 2-day response deadline and includes a fake 'Virus scan completed' banner. The download link points to a VHD file hosted on IPFS via the w3s.link gateway (bafybeiaj6jw2xhbppgji757tn3hg5uu6splaa5gyydkwnzwprzakcp44ve.ipfs.w3s.link). IPFS content-addressed hosting makes traditional URL-based takedowns ineffective — the file persists as long as any IPFS node pins it. At time of analysis, the phishing emails scored 0/0 on VirusTotal.
**Stage 2 — VHD Mount + MotW Bypass:** When the user double-clicks the downloaded VHD file, Windows 10/11 natively mounts it as a new logical drive. Files inside the VHD do NOT inherit the Mark-of-the-Web (MotW) from the container, appearing as local files on a local disk. The mounted drive contains a WSF script with a double extension (purchaseorder...pdf.wsf) designed to trick users into thinking it's a PDF. SmartScreen does not scan files from mounted VHDs as aggressively.
**Stage 3 — WSF → Batch Script Execution:** The WSF file is heavily obfuscated with fragmented string variables. It uses Msxml2.DOMDocument.3.0 COM objects for Base64 decoding (avoiding standard functions) and a rolling XOR decryption with key '4qrttc9sl-sdnYziCVHb8g'. The decrypted output is a batch file written to %TEMP% emp with a random alphanumeric filename (MXVT60Xx6um7nRNl.bat).
**Stage 4 — Obfuscated Batch with Self-Parsing Logic:** The batch file uses environment variable explosion — thousands of SET commands with random variable names that map to individual characters/fragments. After deobfuscation, the batch performs: (1) Anti-analysis checks: admin privilege check via 'net session', VMware detection via WMI Win32_ComputerSystem/BIOS, RAM check (exits if <3GB — anti-sandbox), checks for analyst artifacts ('VBE', 'mapping.csv'). (2) Self-parsing: copies itself to rEgX.cmd, runs mbs.exe (renamed powershell.exe), reads its own content looking for lines starting with '@' to extract the hidden Base64 payload appended at the end. (3) Decryption: Base64 decode → rolling XOR with key 'md' → Invoke-Expression for in-memory execution. The decrypted code never touches disk.
**Stage 5 — Fileless PowerShell Loader + AsyncRAT Injection:** The final PowerShell stage is a sophisticated process injector with: (1) 4-layer string deobfuscation engine (fXZBcHpNzP): Unicode pollution removal → Base64 decode → rolling XOR → ROT character shift. (2) Native API access via Add-Type C# compilation: OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, ReadProcessMemory, VirtualQueryEx. (3) Target process enumeration: RuntimeBroker.exe, OneDrive.exe, taskhostw.exe, sihost.exe — all Microsoft-signed trusted processes. (4) Reinfection marker scanner: checks for byte sequence DEADBECAFEBAEF in target process memory to prevent duplicate injection. (5) Persistence: hidden scheduled task + VBS launcher with rotation logic (self-healing if artifacts removed, generates new randomized task names). (6) Payload stored at C:\ProgramData\IntelDriver\boot64x.w as noise-polluted Base64 data. (7) ~71KB x64 shellcode with entropy >7.7, no PE header — pure encrypted shellcode.
**AsyncRAT Final Payload:** Dynamic analysis confirmed the shellcode deploys a fully functional AsyncRAT implant with: keylogging, screen/webcam capture, clipboard monitoring, file system access, remote command execution, encryp
Target sectors: Manufacturing, Supply Chain, Technology, Healthcare
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1566, T1566, T1204, T1059, T1059, T1059, T1106, T1053, T1027, T1140