SnakeKeylogger Infostealer Delivered via Phishing Emails Disguised as Project Proposals (ASEC, JS→PowerShell Fileless Loader)
SnakeKeylogger Infostealer Delivered via Phishing Emails (TL-2026-1255), also tracked as Snake Stealer, is a medium-severity malware campaign, first published 2026-07-13. It has no confirmed attribution, affects Microsoft Windows (all supported desktop/server versions with, maps to 29 MITRE ATT&CK techniques (T1005, T1012, T1016), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-1255
- Threat ID
- TL-2026-1255
- Also known as
- Snake Stealer, 404 Keylogger, Snake Infostealer
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-13
- Last reviewed
- 2026-07-13
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- all sectors opportunistic commodity phishing, professional services, manufacturing, engineering rfp-driven industries
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in SnakeKeylogger Infostealer Delivered via Phishing Emails
Malware and tooling: 404 Keylogger
ASEC identified an active phishing campaign delivering the SnakeKeylogger (aka Snake Stealer / 404 Keylogger) .NET infostealer through emails disguised as project proposal requests. A compressed attachment contains obfuscated JavaScript that spawns PowerShell to decrypt and reflectively load SnakeKeylogger entirely in memory, which then harvests browser credentials, credit-card data, Outlook profiles, clipboard, screenshots, and keystrokes before exfiltrating over attacker-controlled SMTP or Telegram.
How SnakeKeylogger Infostealer Delivered via Phishing Emails works
On 2026-07-09 ASEC (AhnLab Security Intelligence Center) reported a phishing campaign impersonating legitimate business project-proposal requests to deliver the commodity .NET infostealer SnakeKeylogger (also tracked as Snake Stealer / 404 Keylogger). Victims receive an email with a compressed archive attachment; inside is an obfuscated JavaScript file disguised as a document. When opened, the JavaScript invokes PowerShell.exe and passes an AES-encrypted SnakeKeylogger payload as an inline argument. PowerShell decrypts the payload and executes it directly in the process's memory space without ever writing the final payload to disk, evading disk-based AV/EDR signature detection (fileless execution / defense evasion).
Once resident in memory, SnakeKeylogger's loader unpacks itself in stages: it parses AES-encrypted blobs stored in the .NET assembly's .RSRC resource section, derives the AES-ECB key by SHA-256-hashing a hardcoded key string, and decrypts a secondary loader stage. That stage contains two further AES-ECB-encrypted resource entries, the last of which houses a RUNPE (process-hollowing style) injector module plus the final SnakeKeylogger payload. The malware performs anti-analysis checks before running: a build-date/current-date comparison acts as a kill switch, it uses the native `choice.exe /T` timeout utility to delay execution/cleanup, it enumerates and can terminate known AV/security-tool processes, and it checks the infected host's public IP (via checkip.dyndns.org) against a sandbox/bot IP blocklist, aborting payload execution if a sandbox is detected. It also queries geolocation data from reallygeoip.org as part of victim triage.
For persistence, SnakeKeylogger writes itself to a registry Run key so it survives reboot. It has also been observed dropping a copy of the executable to the user's Temp directory and creating a matching CLR usage-log artifact under `AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\`, consistent with typical .NET obfuscator/protector (e.g. ConfuserEx-style) execution artifacts.
Collection capability is broad: it targets an extensive list of Chromium- and Gecko-based browsers (Chrome, Edge, Opera, Epic Privacy Browser, QQ Browser, etc.) to steal saved passwords and stored credit-card data from the browsers' Login Data / Web Data SQLite stores; it harvests Outlook account/profile configuration directly from the Windows registry; it logs all keystrokes system-wide; it periodically captures desktop screenshots (saved locally as Screenshot.jpg under My Documents before exfiltration); and it monitors and exfiltrates clipboard contents (useful for capturing crypto-wallet addresses and copied credentials). It also performs local system/network reconnaissance (OS/hardware info, installed software enumeration, network configuration) prior to exfiltration.
Exfiltration is configuration-driven and supports three interchangeable channels controlled by build-time flags: FTP (`%FTPDV$`), Telegram bot API (`$%TelegramDv$`), and SMTP (`$%SMTPDV$`). In this campaign the operator configured SMTP exfiltration: stolen data (browser passwords, harvested credentials) is Base64-encoded, packaged into text attachments (observed names such as `Passwords.txt` / `User.txt`), and emailed out via an attacker-controlled SMTP relay (`mail.trimnt.com`, account `nova3@mnt.com`) over TLS/STARTTLS on port 587 to a Gmail drop address (`keishstanford5@gmail.com`). SnakeKeylogger operators are known to abuse compromised third-party mailboxes as SMTP relays to blend exfiltration traffic with legitimate mail flow and to validate successful C2 delivery by checking for a `#$0#` marker string in the server response. This use of a fileless, in-memory-only final payload combined with disposable SMTP/Telegram drop infrastructure is characteristic of the low-cost, high-volume commodity-infostealer-as-a-service ecosystem that SnakeKeylogger (marketed historically as "404 Keylogger") has operated in since 2019-2020.
MITRE ATT&CK techniques used in TL-2026-1255
Collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1114 Email Collection; T1115 Clipboard Data
Discovery
T1012 Query Registry; T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1518 Software Discovery; T1614 System Location Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497.001 System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Credential Access
T1056.001 Keylogging; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1071.003 Mail Protocols; T1105 Ingress Tool Transfer
Persistence
T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1566.001 Spearphishing Attachment
defense-impairment
Affected products and versions in SnakeKeylogger Infostealer Delivered via Phishing Emails
- Microsoft — Windows (all supported desktop/server versions with PowerShell + Windows Script Host enabled)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016-2022 - Google — Chrome / Chromium-based browsers (credential store targeted)
Vulnerable versions: all versions using local DPAPI-protected Login Data store - Microsoft — Outlook (profile/account data harvested from registry)
Vulnerable versions: all versions storing profile config in HKCU
Remediation for SnakeKeylogger Infostealer Delivered via Phishing Emails
Immediate actions
- Block/quarantine inbound email attachments containing compressed archives (.zip/.rar/.7z) with embedded .js/.jse/.wsf script files
- Block outbound SMTP to mail.trimnt.com and outbound traffic to 208.91.199.255:587 at the perimeter/mail gateway
- Alert on and investigate any DNS/HTTP lookups to checkip.dyndns.org or reallygeoip.org immediately preceding suspicious PowerShell activity
- Hunt for the known SHA256/MD5/SHA1 file hashes across EDR telemetry and email gateway logs
- Force-terminate and isolate hosts where wscript.exe/cscript.exe spawned powershell.exe with an inline encoded/argument-passed payload
Workarounds
- Disable Windows Script Host (WSH) execution of .js/.jse/.wsf files via GPO for users who do not require it
- Restrict PowerShell execution to signed scripts only (AllSigned/RemoteSigned + AppLocker) for standard users
Longer-term hardening
- Deploy application allow-listing or Attack Surface Reduction rules to block Office/script-file children spawning PowerShell
- Enable PowerShell Constrained Language Mode and Script Block Logging enterprise-wide
- Enforce mail-gateway sandboxing/detonation for archive attachments containing script files
- Deploy EDR behavioral detections for in-memory .NET assembly loading (reflective/RUNPE injection) rather than relying solely on disk-based signatures
- User awareness training targeting business-proposal / RFP-themed phishing lures
Timeline of SnakeKeylogger Infostealer Delivered via Phishing Emails
- SnakeKeylogger (marketed as '404 Keylogger') first emerges as a significant commodity .NET infostealer/keylogger threat, per Splunk Threat Research Team historical analysis.
- A related SnakeKeylogger sample analyzed by ANY.RUN executes and exfiltrates data at 2023-08-04 16:43:13, using the same checkip.dyndns.org (158.101.44.242) sandbox-check infrastructure and us2.smtp.mailhostbox.com (208.91.199.255:587) SMTP relay later reused in the ASEC campaign.
- ANY.RUN publishes a full walkthrough analysis of a SnakeKeylogger phishing sample ('pago 4094.exe'), documenting the spearphishing-attachment delivery chain, browser/clipboard/keystroke collection, and SMTP exfiltration TTPs referenced in this report.
- Splunk Threat Research Team publishes 'Under the Hood of SnakeKeylogger', detailing the staged AES-ECB resource decryption, RUNPE injection, and FTP/SMTP/Telegram configurable exfiltration architecture used by the loader observed in this campaign.
- Fortinet FortiGuard Labs publishes analysis of an evolving AutoIt-compiled SnakeKeylogger variant (ageless.exe/ageless.vbs) using RegSvcs.exe process hollowing and HTTP POST exfiltration alongside SMTP/Telegram, reporting over 280 million blocked infection attempts and confirming the malware's continued active, evolving deployment.
- Analyzed sample is configured for SMTP-based exfiltration to mail.trimnt.com / nova3@mnt.com, forwarding stolen data to keishstanford5@gmail.com.
- JavaScript attachment execution invokes PowerShell, which decrypts and loads SnakeKeylogger directly into memory without writing the final payload to disk.
- Phishing emails impersonating project-proposal/RFP requests are actively observed in the wild carrying compressed attachments with obfuscated JavaScript loaders.
- ASEC publishes 'Beware of Phishing Emails Disguised as Project Proposals', detailing a phishing campaign that delivers SnakeKeylogger via JavaScript-in-archive attachments and PowerShell fileless execution.
- TL-Intel harness ingests the ASEC report via RSS hunt and opens threat TL-2026-1255 for research and detection engineering.
Sources cited for SnakeKeylogger Infostealer Delivered via Phishing Emails
- Beware of Phishing Emails Disguised as Project Proposals
- Under the Hood of SnakeKeylogger: Analyzing its Loader and its Tactics, Techniques, and Procedures
- Analyzing Snake Keylogger in ANY.RUN: a Full Walkthrough
- Snake infostealer Malware Analysis, Overview by ANY.RUN
- FortiSandbox 5.0 Detects Evolving Snake Keylogger Variant
- Malware Analysis: Snake Keylogger/Snake Stealer
Threats related to SnakeKeylogger Infostealer Delivered via Phishing Emails
- The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWorm
- PhantomStealer Infostealer Distributed via Phishing Campaign with BYOVD Security Software Killer
- Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
- Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot Module — STAC3150 / "Boto Cor-de-Rosa" Campaign Self-Propagates Across Brazil
Detection coverage for TL-2026-1255
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1255 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1255
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.