Modular RAT Campaign Steals Credentials and Captures Screenshots

Seqrite Labs identified "Operation GriefLure," a targeted spear-phishing campaign against senior executives in Vietnam and the Philippines that used highly convincing decoy documents and a modular, fileless RAT (sfsvc.exe with 360.dll) delivered via malicious LNK files; the malware performs credential theft, screenshots, process injection, persistence via DLL sideloading/NTFS ADS, and communicates with C2 infrastructure (e.g., whatsappcenter.com) — multiple file hashes and IOCs are provided.