OBSCURE#BAT Malware Highlights Risks of API Hooking

OBSCURE#BAT is a malware campaign that lures victims with fake captchas and software updates to execute obfuscated batch scripts and PowerShell payloads which ultimately deploy the r77 user‑mode rootkit; r77 uses API hooking to cloak files, registry entries, and processes, making detection difficult. Securonix observed English‑language lures and US‑based infrastructure, recommended defenses include reviewing batch files before execution, enabling Sysmon and PowerShell logging, and combining EDR with SIEM for improved detection and mitigation.