Topic starter
22/07/2026 4:34 pm
TL;DR: A tax-themed phishing campaign impersonating Singapore’s IRAS uses a malicious VHDX image, DLL sideloading, encrypted in-memory shellcode, and anti-analysis checks to deliver Overlord RAT while evading traditional file-based detection, according to Gurucul. The pattern shows how mounted disk images and staged execution can compress user trust, malware delivery, and persistence into one workflow.
Editorial analysis by NHI Mgmt Group, based on content published by Gurucul: “Tax-Themed Phishing Campaign Delivers Overlord RAT via a Malicious VHDX Image”.
Key questions
Q: What breaks when phishing payloads are delivered through mounted VHDX images?
A: Mounted VHDX images break assumptions that downloaded content stays visibly remote and easy to inspect.
Q: Why do DLL side-loading attacks remain effective against traditional endpoint controls?
A: They remain effective because the attack often starts inside a legitimate program and leaves little disk evidence.
Q: What are the signs that a malware loader is using memory-only execution?
A: Look for RWX memory allocation, manual mapping, dynamic import resolution, and rapid stage changes without matching file writes.
Practitioner guidance
- Instrument mounted image execution Alert on downloaded VHDX images that are mounted and then used to launch executables from the new virtual drive, especially when the source domain is newly observed or impersonates a trusted authority.
- Detect sideloading by trusted launchers Build detections for legitimate applications loading unexpected DLLs from the same directory, followed by immediate child-process creation, shellcode decryption, or network activity.
- Correlate anti-analysis behaviour Treat sandbox checks, debugger enumeration, virtualization-driver inspection, and graphics-adapter validation as one behavioural cluster rather than isolated events.
Bottom line: This campaign shows that the real weakness is not one file type but the way trusted containers and familiar launchers can be chained into a stealthy delivery path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 hours ago by NHI Mgmt Group
22/07/2026 4:39 pm
VHDX delivery is a trust-boundary problem, not just a malware-container problem: When attackers use a mountable disk image, they exploit the mental model that local drives are safer than downloaded files. That weakens controls that are built around email attachments and archive inspection alone. Defenders need to treat mounted images as executable delivery surfaces and align monitoring with user-driven mount events.
A question worth separating out:
Q: How should teams respond when phishing combines persistence, evasion, and cleanup?
A: Teams should assume the initial lure is only one stage of the incident and preserve host telemetry as soon as the chain is suspected. Focus on the mount event, sideloaded DLL, persistence artefacts such as Run keys, and any DNS or C2 activity before cleanup removes the visible container. Containment depends on stitching those stages together quickly.
👉 Read our full editorial: Tax-themed phishing now uses VHDX loading to deliver Overlord RAT
This post was modified 6 hours ago by NHI Mgmt Group