DesckVB RAT — Google DoubleClick-Abusing Malspam Kit Delivers Fileless .NET Remote Access Trojan (Huntress) — Threadlinqs Intelligence
As of 2026-06-04, DesckVB RAT — Google DoubleClick-Abusing Malspam Kit Delivers Fileless .NET Remote Access Trojan (Huntress) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-0681 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A malspam campaign active since February 2026 abuses Google's high-reputation DoubleClick Campaign Manager click-tracking domain (ad.doubleclick.net) to bypass email gateways before delivering DesckVB
DesckVB RAT is a .NET-based remote access trojan distributed through a scalable, self-rebranding malspam kit that was first observed in the wild around February 2026 and remained active throughout 2026; Huntress SOC responded to a confirmed intrusion in May 2026. The campaign's defining tradecraft is its abuse of Google's legitimate DoubleClick Campaign Manager click-tracking infrastructure (ad.doubleclick.net) as the first redirect hop, lending the malicious link the reputation of a trusted Google-owned domain that most email security gateways will not block.
The infection begins with a phishing email carrying an HTML attachment (e.g., Bestellung_2026.html). When opened, the page meta-refresh redirects through ad.doubleclick.net and a chain of attacker redirectors (fostercareintheus.optimizationprime.com, bth.startthewave.org). The landing kit decodes the victim's Base64-encoded email address from the URL fragment via setupEmailAndUI(), then dynamically fetches the victim organization's logo through a fallback chain (Clearbit, logo.dev, Google favicons, favicone, DuckDuckGo, /favicon.ico) to personalize a fake 'Download PDF' lure on the fly. Because the kit holds no organization-specific content, swapping the email instantly rebrands the entire lure, making the operation trivially scalable.
Clicking the lure delivers a ZIP archive (A021185521S210008-11521.zip) containing an obfuscated JavaScript loader. The JS loader checks WScript.ScriptFullName; if running from Temp/Downloads it copies itself to C:\Users\Public\ktncm.js, relaunches under wscript.exe //nologo, and exits. On the second run from the stable location it repairs a base64 blob (mangled with literal 'A' characters and the token '9999') via the function vjwNvhDoHz(), decodes it to a PowerShell script written to C:\Users\Public
lbzl.ps1, and runs it with powershell -ExecutionPolicy Bypass -file. The JS is padded with hundreds of dead functions, garbage Unicode, ;;;;; filler, and Portuguese-language comments.
The PowerShell stage fetches a fileless .NET loader DLL (the decoded 01.txt content) executed in memory via .NET reflection, abusing InstallUtil.exe as a LOLBin. The loader acts as a stager: it verifies it is not under analysis, neutralizes host security controls, sets up persistence, and downloads/executes the RAT via process hollowing. Process hollowing targets the Microsoft-signed binaries C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe and MSBuild.exe, using CreateProcessA (suspended), ZwUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, Get/SetThreadContext (and Wow64 variants), and ResumeThread. API names are hidden as base64 strings with '@' characters inserted at random positions, stripped and decoded at runtime for GetProcAddress resolution.
Defense evasion is extensive. On Windows 11 24H2+ (build 26100+) the loader patches AMSI by resolving NtManageHotPatch from ntdll.dll and overwriting its prologue to return STATUS_NOT_SUPPORTED (0xC00000BB). ETW is neutered on 64-bit systems by pattern-scanning ntdll.dll for the EtwEventWrite prologue and overwriting the entry point with xor rax,rax; ret using VirtualProtectEx/WriteProcessMemory/FlushInstructionCache. Microsoft Defender is disabled via PowerShell (real-time monitoring, IPS, MAPS, sample submission) and the entire system drive plus RAT install paths/process names are added as Defender exclusions. The stager performs aggressive sandbox/analysis-tool detection (VirtualBox, VMware, Hyper-V, Parallels, QEMU, Sandboxie/SbieDll.dll, Azure/RDP indicators, BIOS registry checks, and a process/window-title blocklist including Wireshark, OllyDbg, ImmunityDebugger, any.run, joeboxserver, triage). On detection it drops a marker file (vm.txt, Debugger.txt, or 01_detect_analisse_process.txt), deletes it, and reboots via Restart-Computer -Force; a Test-Connection www.google.com check forces a reboot when offline.
Persistence is established through HKCU Run and RunOnce keys named 'Update Driver
Weaknesses (CWE)
CWE-506, CWE-94
Target sectors: multiple, education, healthcare, financial
Target regions: North America, Europe, South America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566, T1027, T1027, T1204, T1059, T1059, T1218, T1620, T1055