Obfuscated VBS and PNG Loaders Power New Open Directory Malware Campaign with RAT Payloads

### Executive summary LevelBlue SpiderLabs investigated a scalable, multi-stage malware campaign that used obfuscated VBS scripts as entry points, fileless PowerShell loaders that fetched PNG files containing Base64-encoded .NET assemblies executed in memory, and hosted reusable payloads (including Remcos RAT and privilege-escalation DLLs) in open directories and cloud infrastructure to maximize stealth and rapid payload rotation.