Remcos RAT Masquerade as VeraCrypt Installers Steals Users Login Credentials

A multi-stage campaign is distributing the Remcos RAT to South Korean users by masquerading malicious installers as VeraCrypt and fake database lookup tools (often targeting illegal gambling users). The attack chain uses obfuscated VBS and PowerShell downloaders, Base64-embedded payloads, and a .NET injector that contacts attackers via Discord webhooks before injecting Remcos into AddInProcess32.exe; the RAT provides full remote control and data-theft features (keylogging, screenshots, webcam/microphone access, and credential extraction).