Tax-themed phishing now uses VHDX loading to deliver Overlord RAT

At a glance

What this is: A tax-themed phishing campaign uses a malicious VHDX image and DLL sideloading to deploy Overlord RAT with layered anti-analysis and persistence steps.

Why it matters: It matters because identity-adjacent trust signals, user execution, and post-compromise control now intersect with endpoint, email, and detection engineering decisions that affect both human and non-human access paths.

👉 Read Gurucul's analysis of the tax-themed VHDX phishing campaign and Overlord RAT

Context

Tax-themed phishing remains effective because it exploits urgency, legitimacy, and routine administrative pressure rather than technical novelty. In this campaign, the lure is a government-style compliance notice that leads the victim to mount a VHDX file and execute a local application, which turns a familiar business workflow into an initial access path.

The primary security issue is not the file format itself but the trust model around user-initiated execution from mounted media. That matters for IAM and NHI practitioners because the same design pattern appears whenever a workflow assumes trusted execution after authentication, whether the actor is a person, service account, or automated process.

Key questions

Q: What breaks when malicious VHDX files are allowed into normal user workflows?

A: They collapse the boundary between external delivery and local execution. Once a user mounts the disk, the payload sits inside a trusted-looking volume that can bypass simple attachment filtering and user suspicion. Security teams need to treat virtual disk images as active delivery containers, not passive storage files, and correlate them with process, mount, and network telemetry.

Q: Why do attackers use DLL sideloading and in-memory execution together?

A: Because the combination reduces on-disk evidence and delays detection. A legitimate executable loads the malicious DLL, which then decrypts or stages shellcode directly in memory. That means file hashes and static scanning are less reliable, so defenders need behavioural detection around module loading, process ancestry, and memory execution patterns.

Q: What do security teams get wrong about sandbox evasion in malware?

A: They often treat evasion as a sign that a sample is harmless if it fails in the lab. In reality, sandbox and VM checks are proof the malware is trying to protect its payload from analysis. Teams should use those checks as detection signals and hunt for the same behaviour on enterprise endpoints.

Q: Who is accountable when malware uses legitimate tools to hide persistence and credential theft?

A: Accountability sits across endpoint security, IAM, and platform operations because the abuse spans services, local credentials, and detection engineering. Security teams should map which group owns registry monitoring, which owns credential revocation, and which owns containment actions so no stage of the compromise is left unowned.

Technical breakdown

How malicious VHDX images change the initial execution model

A VHDX file is a virtual disk image that Windows can mount natively, so it often feels less suspicious than a compressed archive or downloaded executable. In this campaign, the mounted volume contains a legitimate-looking application plus supporting DLLs, which shifts the attack from email delivery to local execution. The key technical advantage is trust inheritance: once the user mounts the disk and opens the app, the malware executes in a context that appears locally sourced and operationally normal. That reduces the friction defenders usually rely on when they detect downloaded binaries or obvious macro-enabled documents.

Practical implication: monitor mounted virtual disks, especially when they originate from phishing links or newly registered domains.

DLL sideloading and in-memory shellcode reduce on-disk evidence

DLL sideloading works when a legitimate executable loads a DLL from its own directory before loading the intended library. Here, the malicious event.dll runs first, forwards expected calls to the original library, and uses that execution window to decrypt shellcode in memory. Because the final payload is not written to disk in plaintext, traditional file scanning sees less of the attack chain. The same pattern is common in malware families that combine loader stealth with staged payload delivery, where the objective is not just to run code but to minimise recoverable artifacts.

Practical implication: correlate unexpected DLL loads with parent process reputation and memory execution events, not just file hashes.

Anti-analysis checks make detonation environments less reliable

The loader checks usernames, hostnames, processes, graphics adapters, and virtualization drivers before deploying the payload. It also decrypts strings at runtime, which removes obvious indicators from static inspection. This layering matters because a single sandbox evasion check is easy to tune out, but multiple checks spread across user identity, process discovery, and hardware artefacts raise the cost of analysis. For defenders, the lesson is that malware increasingly treats the environment as a gate, not a passive backdrop. Detection has to account for behaviour that stops early when it suspects analysis.

Practical implication: enrich telemetry with host environment context so early-terminated detonations still contribute to detection logic.

Threat narrative

Attacker objective: The attacker wants persistent remote access to the endpoint while keeping the intrusion difficult to detect, investigate, and attribute.

1. Entry begins with a tax-themed phishing email impersonating the Inland Revenue Authority of Singapore and directing the victim to download a malicious VHDX image from a lookalike site.
2. Escalation occurs when the victim mounts the disk, launches the bundled executable, and the malicious DLL sideloads shellcode into memory while evading analysis checks.
3. Impact follows deployment of Overlord RAT, which establishes persistence, command-and-control, reconnaissance, and post-execution cleanup that removes the mounted disk image.

NHI Mgmt Group analysis

Mounted media trust is a real execution boundary problem: When attackers shift delivery into a VHDX container, they exploit the gap between email trust and local execution trust. Traditional controls often inspect the attachment or the URL, then relax once the victim opens the mounted volume. That creates a governance blind spot for endpoint and identity teams that assume downloaded content is still 'external' after mounting. Practitioners should treat mounted disk images as a distinct execution channel, not a benign file format.

File-based detection is losing ground to staged memory execution: The campaign shows why malware loaders now aim to leave as little on disk as possible. DLL sideloading, runtime decryption, and shellcode execution move the decisive steps into memory, where prevention and forensic recovery are weaker. That shifts the control conversation from hash matching to behavioural correlation, especially across process lineage, memory events, and abnormal module loading.

Anti-analysis behaviour is becoming a first-class defensive signal: The loader does not merely hide, it evaluates whether the environment looks like a sandbox, VM, or analyst workstation before proceeding. That means early aborts are not evidence of safety, they are evidence of intent. Security programmes should treat deliberate environment checking as a malicious precursor, because it signals a loader designed to survive real enterprise endpoints rather than laboratories.

Overlord RAT-style post-exploitation should be read as identity risk, not only malware risk: Once remote access is established, the operator can pivot into credential capture, system discovery, and lateral movement opportunities that affect both human and non-human identity surfaces. That is where endpoint compromise becomes an IAM and PAM problem as well as a malware problem. The practical conclusion is that access governance must assume post-compromise identity abuse will follow endpoint footholds.

What this signals

Mounted media delivery will keep blurring the boundary between endpoint compromise and identity compromise: once a user executes code from a mounted disk image, the attacker has effectively gained a foothold that can be used to target credentials, browser sessions, and administrative tools. That makes endpoint telemetry, identity telemetry, and network telemetry part of the same detection problem, not separate projects.

Detection programmes need a concept of trust inversion: a file that appears local can still be attacker-controlled, and a process that looks legitimate can still be the first stage of a loader chain. This is the sort of control gap that exposes programmes relying too heavily on file reputation or a single sandbox verdict. The practical shift is toward behavioural correlation and host context enrichment.

The incident also reinforces why identity teams should care about post-exploitation tooling even when the initial compromise is endpoint-led. If Overlord RAT reaches credential harvesting or remote administration workflows, the security boundary shifts into access governance, where stale privileges and weak revocation speed become material exposure factors.

For practitioners

• Instrument mounted VHDX execution paths Alert when users mount VHD or VHDX images from newly observed domains, especially if the mounted volume contains a single launcher executable and supporting DLLs. Correlate this with email or web delivery telemetry so the initial lure and the local execution event are reviewed together.
• Detect unexpected DLL sideloading chains Build detection logic for trusted executables loading same-directory DLLs that are unsigned, unusual for the application, or followed by in-memory shellcode activity. Use parent-child process correlation and module load sequences to separate normal software behaviour from loader tradecraft.
• Treat anti-analysis checks as malicious precursor activity Flag process enumeration for debugging tools, virtualization driver inspection, and host-name or username checks that reference sandbox or analysis environments. These behaviours often appear before payload deployment and can provide an earlier containment point than waiting for the final RAT to run.
• Track persistence created through user-level Run keys Watch for new values under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that mimic Windows components or appear after a suspicious download-and-mount sequence. Cross-check with hidden PowerShell, DNS lookups, and subsequent outbound connections to confirm whether the key is part of a staged intrusion.

Key takeaways

• This campaign shows how a familiar phishing lure can become a multi-stage loader chain when attackers combine VHDX mounting, sideloading, and in-memory execution.
• The strongest evidence of risk is behavioural, not file-based, because anti-analysis checks, persistence, and cleanup are all designed to reduce static visibility.
• Teams should harden mounted media workflows, detect sideloading patterns, and treat endpoint compromise as a downstream identity governance problem when credentials may be exposed.

Key terms

• VHDX Image: A VHDX image is a virtual hard disk file that Windows can mount like a real drive. In malware campaigns, that native trust can be abused to package executables and DLLs inside what looks like local storage, reducing user suspicion and sometimes bypassing simple attachment controls.
• DLL Sideloading: A technique where a legitimate executable loads a malicious library from a location the application checks before the real system path. It works because the program’s trust is inherited by the code it loads, which makes execution control as important as file reputation.
• In-Memory Shellcode Execution: In-memory shellcode execution is a technique where decrypted payload code runs directly in memory rather than being written to disk as a normal executable. That approach limits file-based indicators, complicates static analysis, and shifts defensive value toward behavioural monitoring and memory-aware detection.
• Sandbox evasion: Sandbox evasion is the practice of making malware or phishing infrastructure behave differently when inspected by automated analysis tools. Attackers may check headers, JavaScript execution, IP reputation, or browsing patterns so that the malicious content is hidden from the scanner.

What's in the full report

Gurucul's full blog covers the operational detail this post intentionally leaves for the source:

• Full MITRE ATT&CK mapping with observed techniques and stage-by-stage evidence from the sample analysis.
• Indicators of compromise including file hashes, command-and-control address, and the malicious VHDX filename.
• Detection opportunities for SIEM and XDR correlation across mounted media, sideloading, persistence, and DNS activity.
• Malware analysis notes on RC4 key recovery, shellcode execution, and codebase similarity to public Overlord RAT.

👉 Gurucul's full post covers the attack chain, evasion techniques, and indicators of compromise in detail.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners building stronger access controls across identity, endpoint, and cloud-adjacent workflows.