A Simple 'Payment is Underway' Phishing Email Downloads RATs from AWS, GitHub

Fortinet analysis describes a simple but effective phishing campaign that uses a malicious Java downloader hosted on legitimate services (AWS, GitHub) and obfuscated with Branchlock to deliver remote access trojans (VCURMS and STRRAT), a keylogger, and password-recovery malware. The attack begins with a 'Remittance Summary' email containing an image link to the Java payload, demonstrating how one-click phishing and use of public repositories can enable credential theft and remote access while evading detection.