Threat reportMalwareTL-2026-1740
AutoIT Payload Injector Delivers VIPKeylogger via Phishing/RAR Chain into charmap.exe
AutoIT Payload Injector Delivers VIPKeylogger via (TL-2026-1740) is a medium-severity malware campaign, first published 2026-07-28. It has no confirmed attribution, affects Microsoft Windows (Character Map utility - charmap.exe), maps to 21 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1740
- Threat ID
- TL-2026-1740
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- financial services, general commercial mass-distribution malspam
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in AutoIT Payload Injector Delivers VIPKeylogger via
Malware and tooling: 404 Keylogger, VIP Keylogger, AutoIT3
How AutoIT Payload Injector Delivers VIPKeylogger via works
SANS ISC (diary #33192, Xavier Mertens) documents a banking-themed phishing campaign delivering a RAR archive whose VBS→PowerShell→AutoIT3 chain injects XOR/Base64-obfuscated shellcode into the legitimate charmap.exe process via OpenProcess/VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, ultimately running VIPKeylogger with C2 at cphost17.qhoster.net.
On 2026-07-28, SANS Internet Storm Center handler Xavier Mertens published diary entry #33192 describing an active malware-delivery chain observed in the wild. The lure is a fraudulent banking-themed phishing email carrying the attachment 'Bank_account_details.rar' (SHA256 5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab). Inside the archive is an obfuscated VBS script (SHA256 f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f) that Base64-decodes an embedded payload and shells out to 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' to decompress it via a GzipStream .NET call. This drops three additional Base64/XOR-obfuscated (XOR keys 0x02 and 0x3D) files: a renamed, randomly-named AutoIT3 script interpreter 'vijewyufveonabghulluonouceyasi.exe' (SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1), an AutoIT injection script 'wwman', and a raw shellcode blob 'Ennnn'. The AutoIT3 interpreter executes 'wwman', which XOR-decrypts 'Ennnn' with key 0xEC and injects the resulting shellcode into the legitimate Windows Character Map utility (charmap.exe) using the classic remote-injection API sequence: OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread (CloseHandle to clean up handles afterward). Using a non-network-facing, rarely-monitored GUI accessibility utility as the injection host is a deliberate detection-evasion choice — EDR/SOC baselines rarely expect charmap.exe to make outbound network connections or host writable+executable memory. Persistence is established via a registry Run key (HKCU\...\CurrentVersion\Run, value name 'Windows32') pointing back at the dropped executable with the argument 'wwmaw', ensuring re-execution at each logon. The chain culminates in deployment of VIPKeylogger, which beacons to C2 domain cphost17[.]qhoster[.]net; the hostname's 'cphost17' prefix is consistent with a cPanel-style hosting subdomain naming pattern, suggesting the actor is riding on shared/commercial hosting rather than dedicated bulletproof infrastructure, though this was not independently confirmed. VIPKeylogger itself is a widely-tracked, subscription-based .NET information stealer/keylogger sold in crimeware-as-a-service channels; it is closely related to (shares code/behavior lineage with) Snake Keylogger (aka 404 Keylogger). Independent vendor research (Splunk Threat Research Team, Forcepoint X-Labs, SOCPrime, PCrisk) documents the family's typical capabilities as: keystroke logging, screenshot capture, clipboard monitoring with cryptocurrency-address-swapping ('clipper') behavior, Wi-Fi password extraction from previously-connected networks, browser-stored credential theft, and exfiltration over channels including Telegram bot APIs and dedicated/DuckDNS-style C2 endpoints, frequently preceded by multi-stage VBS/JS/batch loaders using junk-code padding, PNG steganography, and environment-variable staging to evade static and sandbox analysis. Those family-level TTPs are documented for VIPKeylogger broadly and were not all independently re-verified by SANS ISC for this specific charmap.exe-injection variant, but they characterize the payload's expected post-injection behavior once active on a victim host. No CVE is associated with this campaign (it exploits process trust and phishing, not a software vulnerability), and it does not appear in the CISA KEV catalog. Given the banking-themed social-engineering lure combined with a credential/keystroke-stealing payload, financial gain is the most plausible motivation; no specific threat actor or nation-state attribution has been published.
MITRE ATT&CK techniques used in TL-2026-1740
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture; T1115 Clipboard Data
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Privilege Escalation
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1059.010 AutoHotKey & AutoIT; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in AutoIT Payload Injector Delivers VIPKeylogger via
- Microsoft — Windows (Character Map utility - charmap.exe)
Vulnerable versions: All Windows client/server versions shipping charmap.exe (used here only as an injection host, not as a vulnerable component)
Remediation for AutoIT Payload Injector Delivers VIPKeylogger via
Immediate actions
- Block/sinkhole the C2 domain cphost17.qhoster.net at DNS resolvers, web proxies, and perimeter firewalls
- Search mail gateway and EDR telemetry for the attachment 'Bank_account_details.rar' and its SHA256 (5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab)
- Hunt for charmap.exe processes exhibiting anomalous RWX memory regions, unexpected outbound network connections, or remote threads created by a non-standard parent process
- Alert on execution of randomly-named executables that load the legitimate AutoIT3 interpreter (pattern: long random alphabetic filename, e.g. 'vijewyufveonabghulluonouceyasi.exe')
Workarounds
- Disable or restrict Windows Script Host (wscript.exe / cscript.exe) for standard users where VBS execution is not a business requirement
- Monitor and alert on writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run for unexpected value names such as 'Windows32'
- Block inbound archive attachments (RAR/ZIP) containing script files (.vbs/.js/.bat) at the email gateway
Longer-term hardening
- Deploy EDR behavioral analytics for the classic remote process-injection API sequence (OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread) targeting rarely-network-active GUI utilities such as charmap.exe
- Enable PowerShell Script Block Logging / AMSI inspection to catch Base64-decode + GzipStream decompression one-liners staged from VBS loaders
- Enforce application allowlisting / WDAC policy to block unauthorized execution of AutoIT3.exe outside of approved administrative use
- Deliver user awareness training targeting banking/financial-themed phishing lures that deliver password-protected or plain RAR/ZIP archives
Timeline of AutoIT Payload Injector Delivers VIPKeylogger via
- SANS Internet Storm Center handler Xavier Mertens publishes diary #33192, documenting the full infection chain, injection technique, and IOCs.
- VIPKeylogger initiates outbound command-and-control communication to cphost17[.]qhoster[.]net for data exfiltration.
- VIPKeylogger becomes active inside charmap.exe's memory space and begins credential, keystroke, and clipboard harvesting.
- The injected payload establishes persistence via an HKCU ...\CurrentVersion\Run registry value named 'Windows32', re-invoking the dropped executable with argument 'wwmaw' at each logon.
- The AutoIT3 interpreter runs 'wwman', which XOR-decrypts 'Ennnn' with key 0xEC and injects the resulting shellcode into charmap.exe via OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread.
- PowerShell drops three Base64/XOR-obfuscated (keys 0x02, 0x3D) files: the AutoIT3 interpreter 'vijewyufveonabghulluonouceyasi.exe' (SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1), the AutoIT script 'wwman', and the shellcode blob 'Ennnn'.
- The VBS script executes, Base64-decodes an embedded payload, and invokes powershell.exe to decompress it via a .NET GzipStream call.
- Victim opens the RAR archive, revealing an obfuscated VBS script (SHA256 f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f).
- Victim receives fraudulent banking-themed phishing email carrying RAR attachment 'Bank_account_details.rar' (SHA256 5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab).
Sources cited for AutoIT Payload Injector Delivers VIPKeylogger via
- AutoIT Payload Injector
- Behind the Code: The Layered Defense-Evasion of VIP Keylogger
- Analytics Story: VIP Keylogger
- VIPKeyLogger Infostealer in the Wild
- VIP Keylogger Uses Steganography and Script Obfuscation
- VipKeyLogger Malware - Malware removal instructions
- Hackers Deploy VIP Keylogger Through Phishing Emails Masquerading as Business Documents
- New VIPKeyLogger Via Weaponized Office Documents Steals Login Credentials
- MITRE ATT&CK Enterprise Matrix
Detection coverage for TL-2026-1740
As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1740 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.