SnakeKeylogger: A Multistage Info Stealer Malware Campaign

**SnakeKeylogger campaign:** Seqrite Labs documents a multi-stage info‑stealer delivered via malicious .img attachments that mounts a virtual drive to run a small .NET downloader which fetches and decodes an in‑memory Stage2 DLL; the payload uses heavy obfuscation, process hollowing (InstallUtil.exe), and in‑memory DLL loading to exfiltrate credentials from browsers, email clients (including Outlook profiles), FTP (FileZilla), and Wi‑Fi configurations, with active malicious payload hosting observed at http://103.72.56.30/PHANTOM/ and several MD5 IOCs provided.