Malicious GST Debit Note Attachment Deploys Remcos RAT Through Multi-Stage Loader

A phishing campaign targeting users in India delivers a multi-stage, in-memory loader hidden in a deceptive "GST Debit Note" .NET executable that ultimately deploys Remcos RAT (and other commodity stealers) using steganographic resource embedding and process hollowing; the malware achieves persistence, credential/cookie theft, audio/webcam capture, and exfiltration to identified C2 IPs, and the report includes multiple MD5 hashes and IP indicators.