Researchers Uncover Hidden Threat: ‘PEAKLIGHT’ Memory Malware Exposed

This report describes a malicious campaign that distributes a memory-only JavaScript dropper via LNK files in ZIPs (masquerading as movie files) which triggers a PowerShell downloader named PEAKLIGHT; PEAKLIGHT retrieves and executes multiple infostealer families (LUMMAC2, SHADOWLADDER, CRYPTBOT) hosted on CDNs, using obfuscation, living-off-the-land binaries (mshta.exe, forfiles.exe), and encrypted payloads to evade detection and persist.