Remcos RAT Attack Uses Obfuscated Scripts, Trusted Windows Tools

This report documents a Remcos RAT phishing campaign where an obfuscated JavaScript payload delivered via a ZIP attachment fetches an encoded PowerShell script (ENCRYPT.ps1) that decodes Base64/XOR blobs, reflectively loads a .NET assembly and an in-memory PE, and abuses aspnet_compiler.exe as a LOLBin to execute and proxy malicious code; active C2 communications to 192.3.27.141:8087, keystroke logging, and multiple IOCs (file hashes, filenames, and a malicious URL) are provided, and defenders are advised to monitor script/PowerShell telemetry, LOLBin behavior, and outbound C2 patterns.