ViperSoftX variant spotted abusing .NET runtime to disguise data theft

ViperSoftX, a rapidly evolving infostealer, has reemerged with enhanced obfuscation by leveraging the .NET CLR and AutoIt to hide and execute PowerShell payloads; Trellix's analysis shows the malware buries commands in fake JPGs, installs AutoIt and PowerShell scripts, creates scheduled tasks to persist and disable AMSI, and aims to steal system information and cryptocurrency wallets—samples were found bundled with a pirated Excel eBook distributed via torrents.