Notifications
Clear all
Topic starter
22/07/2026 4:34 pm
TL;DR: A tax-themed phishing campaign impersonating Singapore’s IRAS uses a malicious VHDX image, DLL sideloading, encrypted in-memory shellcode, and anti-analysis checks to deliver Overlord RAT while evading traditional file-based detection, according to Gurucul. The pattern shows how mounted disk images and staged execution can compress user trust, malware delivery, and persistence into one workflow.
NHIMG editorial — based on content published by Gurucul: Tax-themed phishing campaign delivers Overlord RAT via a malicious VHDX image
Questions worth separating out
Q: What breaks when malicious VHDX files are allowed into normal user workflows?
A: They collapse the boundary between external delivery and local execution.
Q: Why do attackers use DLL sideloading and in-memory execution together?
A: Because the combination reduces on-disk evidence and delays detection.
Q: What do security teams get wrong about sandbox evasion in malware?
A: They often treat evasion as a sign that a sample is harmless if it fails in the lab.
Practitioner guidance
- Instrument mounted VHDX execution paths Alert when users mount VHD or VHDX images from newly observed domains, especially if the mounted volume contains a single launcher executable and supporting DLLs.
- Detect unexpected DLL sideloading chains Build detection logic for trusted executables loading same-directory DLLs that are unsigned, unusual for the application, or followed by in-memory shellcode activity.
- Treat anti-analysis checks as malicious precursor activity Flag process enumeration for debugging tools, virtualization driver inspection, and host-name or username checks that reference sandbox or analysis environments.
What's in the full report
Gurucul's full blog covers the operational detail this post intentionally leaves for the source:
- Full MITRE ATT&CK mapping with observed techniques and stage-by-stage evidence from the sample analysis.
- Indicators of compromise including file hashes, command-and-control address, and the malicious VHDX filename.
- Detection opportunities for SIEM and XDR correlation across mounted media, sideloading, persistence, and DNS activity.
- Malware analysis notes on RC4 key recovery, shellcode execution, and codebase similarity to public Overlord RAT.
👉 Read Gurucul's analysis of the tax-themed VHDX phishing campaign and Overlord RAT →
Malicious VHDX phishing chains are changing endpoint detection priorities?
Explore further
22/07/2026 4:39 pm
Mounted media trust is a real execution boundary problem: When attackers shift delivery into a VHDX container, they exploit the gap between email trust and local execution trust. Traditional controls often inspect the attachment or the URL, then relax once the victim opens the mounted volume. That creates a governance blind spot for endpoint and identity teams that assume downloaded content is still 'external' after mounting. Practitioners should treat mounted disk images as a distinct execution channel, not a benign file format.
A question worth separating out:
Q: Who is accountable when malware uses legitimate tools to hide persistence and credential theft?
A: Accountability sits across endpoint security, IAM, and platform operations because the abuse spans services, local credentials, and detection engineering. Security teams should map which group owns registry monitoring, which owns credential revocation, and which owns containment actions so no stage of the compromise is left unowned.
👉 Read our full editorial: Tax-themed phishing now uses VHDX loading to deliver Overlord RAT
