Remcos RAT Delivered by a Steganographic Loader in Phishing Emails

K7 Security Labs identified a phishing campaign targeting Windows users in India that uses an archive attachment and a steganographic .NET loader chain to deliver Remcos RAT entirely in memory; the RAT performs persistence, process hollowing, keylogging, webcam/audio capture, and browser credential theft, and the same loader infrastructure has been observed delivering multiple other malware families.