Threat reportMalwareTL-2026-3539
SnakeKeylogger Infostealer Delivered via Phishing Emails Disguised as Purchase Orders (Malicious DOCX / Equation Editor)
SnakeKeylogger Infostealer Delivered via Phishing Emails (TL-2026-3539) is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Microsoft Office (Equation Editor component), maps to 19 MITRE ATT&CK techniques (T1027.013, T1048, T1056.001), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-3539
- Threat ID
- TL-2026-3539
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- business services, supply chain procurement, general enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in SnakeKeylogger Infostealer Delivered via Phishing Emails
Malware and tooling: 404 Keylogger
How SnakeKeylogger Infostealer Delivered via Phishing Emails works
AhnLab ASEC reports a phishing campaign using spoofed purchase-order emails with a malicious DOCX that embeds an RTF exploiting the Equation Editor, leading to VBS/PowerShell execution, a Python-based multi-layer-encrypted loader and SnakeKeylogger deployment. The infostealer exfiltrates keystrokes, clipboard, screenshots and credentials via SMTP.
AhnLab ASEC (published 2026-10-09) documents a phishing campaign in which emails spoofed as purchase-order confirmations ask the recipient to review the attached purchase order and reply with the relevant information. The attachment, named PURCHASED ORDER.Docx, embeds an RTF file (niza.Rtf) that is loaded through the WordprocessingML altChunk element. The RTF contains an Equation.3 object that exploits the Microsoft Equation Editor vulnerability; the ASEC article does not state a CVE number, so none is asserted here.
On exploitation the RTF launches 'cmd.exe /C cscript %TMP%\832734.Vbs'. The VBS script writes a Base64-encoded blob to %APPDATA%\Tempor.Zip, starts PowerShell in hidden mode, decodes the Base64 data to a temporary ZIP with a random GUID name, deletes and recreates %USERPROFILE%\AppData\Roaming\Templates\python312x86, extracts the archive there and runs Protected.Py with pythonw.exe (a bundled Python 3.12 x86 runtime).
Protected.Py Base64-decodes the neighbouring file Excepteur.Dal and decrypts it through a sequential Salsa20 -> ChaCha20 -> RC4 -> XOR chain. The decrypted content is a PE loader plus shellcode; the loader is mapped into memory and the shellcode executes the final SnakeKeylogger payload.
SnakeKeylogger establishes persistence through a Registry Run key, logs keystrokes, clipboard data and screenshots, harvests Wi-Fi passwords, browser and email account credentials, FileZilla logins and Discord tokens, and collects the victim's public IP and location. Stolen data is exfiltrated by SMTP through the mail server cphost17.qhoster.net on port 587, sent from obsender4snake@exzwzc.com to kingmethodlogs2026@exzwzc.com. No threat actor attribution is stated in the source. A BeaconBeagle config search for exzwzc.com returned no records.
MITRE ATT&CK techniques used in TL-2026-3539
Defense Evasion
T1027.013 Encrypted/Encoded File; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Credential Access
T1056.001 Keylogging; T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1203 Exploitation for Client Execution; T1204.002 Malicious File
Collection
Persistence
T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1566.001 Spearphishing Attachment
Discovery
Affected products and versions in SnakeKeylogger Infostealer Delivered via Phishing Emails
Remediation for SnakeKeylogger Infostealer Delivered via Phishing Emails
Patches
- Apply Microsoft Office security updates that address the Equation Editor vulnerability and remove or disable the legacy Equation Editor component (EQNEDT32.EXE)
Immediate actions
- Block cphost17.qhoster.net and exzwzc.com at mail and DNS gateways and alert on outbound SMTP (587) from non-mail-server hosts
- Quarantine emails with DOCX attachments named PURCHASED ORDER.Docx and search mailboxes for the sender and lures
- Hunt for %APPDATA%\Roaming\Templates\python312x86, Tempor.Zip, 832734.Vbs and pythonw.exe running Protected.Py
- Reset credentials, browser-stored passwords, FileZilla logins, Wi-Fi keys and Discord tokens on affected hosts
Workarounds
- Block or strip RTF/embedded-object content and DOCX altChunk external content at the mail gateway
- Open Office documents from email in Protected View and block Office child-process creation with ASR rules
- Block execution of script hosts (wscript/cscript) for non-administrative users
Longer-term hardening
- Alert on Office applications spawning cmd.exe, cscript.exe or PowerShell
- Restrict outbound SMTP to authorized mail relays
- Deploy EDR with behavioral detection for in-memory PE/shellcode loading and Run key persistence
- Train users to treat unexpected purchase-order attachments as suspicious
Timeline of SnakeKeylogger Infostealer Delivered via Phishing Emails
- Stolen data is sent over SMTP (port 587) via cphost17.qhoster.net from obsender4snake@exzwzc.com to kingmethodlogs2026@exzwzc.com
- Shellcode runs SnakeKeylogger, which sets a Registry Run key and begins harvesting keystrokes, clipboard, screenshots and credentials
- Protected.Py decodes Excepteur.Dal using Salsa20, ChaCha20, RC4 and XOR layers and maps a PE loader and shellcode into memory
- VBS drops Tempor.Zip, runs hidden PowerShell, extracts the Python 3.12 x86 runtime to %APPDATA%\Templates\python312x86 and launches Protected.Py via pythonw.exe
- DOCX loads embedded niza.Rtf via altChunk; its Equation.3 object exploits the Equation Editor and runs cmd.exe /C cscript %TMP%\832734.Vbs
- Phishing emails spoofed as purchase-order confirmations deliver the malicious DOCX PURCHASED ORDER.Docx
- AhnLab ASEC publishes 'Beware of Phishing Emails Disguised as Purchase Orders' describing the SnakeKeylogger campaign
Sources cited for SnakeKeylogger Infostealer Delivered via Phishing Emails
- Beware of Phishing Emails Disguised as Purchase Orders (AhnLab ASEC)
- Purchase order malspam delivers Snake Keylogger (Infoblox)
- Malicious PDF attachments used to spread Snake Keylogger malware (SC Media)
- Threat experts found a Snake Keylogger malware distributed using PDF attachments
- Snake Keylogger is spread via malicious PDFs (SecureLayer7)
- ANY.RUN sandbox report for a SnakeKeylogger sample
Detection coverage for TL-2026-3539
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3539 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.