This research paper analyzes a sophisticated multi-stage attack delivering VIPKeyLogger through phishing emails. It details the complete infection chain, starting from malicious RTF files to VBScript, PowerShell, and in-memory loaders. The document explains advanced techniques such as process hollowing, image-based payload hiding, and Defender evasion. VIPKeyLogger’s capabilities include credential theft, keystroke logging, and targeting email and communication tools. The paper maps techniques to MITRE ATT&CK and provides indicators of compromise to aid detection and response.

Join for free to read