# SnakeKeylogger Infostealer Delivered via Phishing Emails Disguised as Purchase Orders (Malicious DOCX / Equation Editor)

> AhnLab ASEC reports a phishing campaign using spoofed purchase-order emails with a malicious DOCX that embeds an RTF exploiting the Equation Editor, leading to VBS/PowerShell execution, a Python-based multi-layer-encrypted loader and SnakeKeylogger deployment. The infostealer exfiltrates keystrokes, clipboard, screenshots and credentials via SMTP.

- **Published:** 2026-10-14T19:07:52Z
- **Last reviewed:** 2026-10-14T19:07:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3539
- **ID:** TL-2026-3539
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab ASEC (published 2026-10-09) documents a phishing campaign in which emails spoofed as purchase-order confirmations ask the recipient to review the attached purchase order and reply with the relevant information. The attachment, named PURCHASED ORDER.Docx, embeds an RTF file (niza.Rtf) that is loaded through the WordprocessingML altChunk element. The RTF contains an Equation.3 object that exploits the Microsoft Equation Editor vulnerability; the ASEC article does not state a CVE number, so none is asserted here.

On exploitation the RTF launches 'cmd.exe /C cscript %TMP%\832734.Vbs'. The VBS script writes a Base64-encoded blob to %APPDATA%\Tempor.Zip, starts PowerShell in hidden mode, decodes the Base64 data to a temporary ZIP with a random GUID name, deletes and recreates %USERPROFILE%\AppData\Roaming\Templates\python312x86, extracts the archive there and runs Protected.Py with pythonw.exe (a bundled Python 3.12 x86 runtime).

Protected.Py Base64-decodes the neighbouring file Excepteur.Dal and decrypts it through a sequential Salsa20 -> ChaCha20 -> RC4 -> XOR chain. The decrypted content is a PE loader plus shellcode; the loader is mapped into memory and the shellcode executes the final SnakeKeylogger payload.

SnakeKeylogger establishes persistence through a Registry Run key, logs keystrokes, clipboard data and screenshots, harvests Wi-Fi passwords, browser and email account credentials, FileZilla logins and Discord tokens, and collects the victim's public IP and location. Stolen data is exfiltrated by SMTP through the mail server cphost17.qhoster.net on port 587, sent from obsender4snake@exzwzc.com to kingmethodlogs2026@exzwzc.com. No threat actor attribution is stated in the source. A BeaconBeagle config search for exzwzc.com returned no records.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1059.006 Python
- T1547.001 Registry Run Keys / Startup Folder
- T1140 Deobfuscate/Decode Files or Information
- T1027.013 Encrypted/Encoded File
- T1620 Reflective Code Loading
- T1056.001 Keylogging
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1113 Screen Capture
- T1614 System Location Discovery
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Beware of Phishing Emails Disguised as Purchase Orders (AhnLab ASEC)](https://asec.ahnlab.com/en/95841/)
- [Purchase order malspam delivers Snake Keylogger (Infoblox)](https://www.infoblox.com/blog/threat-intelligence/purchase-order-malspam-delivers-snake-keylogger/)
- [Malicious PDF attachments used to spread Snake Keylogger malware (SC Media)](https://www.scworld.com/brief/malware/malicious-pdf-attachments-used-to-spread-snake-keylogger-malware)
- [Threat experts found a Snake Keylogger malware distributed using PDF attachments](https://www.thetechoutlook.com/news/threat-experts-found-a-snake-keylogger-malware-distributed-using-pdf-attachments/)
- [Snake Keylogger is spread via malicious PDFs (SecureLayer7)](https://cyberdaily.securelayer7.net/the-snake-keylogger-is-spread-via-malicious-pdfs/)
- [ANY.RUN sandbox report for a SnakeKeylogger sample](https://any.run/report/a336288cf2d4517d6fcb620338222187273070ff8a28025849e2dfeda56d4982/80e53056-3128-44b2-ad05-67897d9915cc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3539