DesckVB RAT Uses Obfuscated JavaScript and Fileless .NET Loader to Evade Detection

This report analyzes DesckVB RAT, a 2026-era fileless Remote Access Trojan that uses heavily obfuscated JavaScript and PowerShell to load .NET assemblies directly into memory via reflection and process injection. It documents capabilities including keylogging, webcam access, AV-evasion and encrypted C2 communications, and provides IOCs (manikandan83.mysynology.net, 45.156.87.226:7535) and behavioral indicators (use of InstallUtil.exe, scripts dropped to C:\Users\Public), with recommended detection and mitigation steps such as blocking script execution, enabling detailed PowerShell logging, and keeping endpoint protection up to date.