Azorult Malware Abuses Google Sites To Steal Login Credentials

A sophisticated Azorult campaign leverages HTML smuggling on Google Sites to deliver a JSON-hosted base64 payload which is executed filelessly using PowerShell reflective loading and an AMSI bypass; the malware (Azorult) runs in memory to harvest credentials, browser data, screenshots, and crypto wallet information before encrypting and exfiltrating it to a C2 server, with reported targeting of the healthcare sector.