Cagey Phishing Campaign Delivers Multiple RATs to Steal Windows Data

Fortinet's FortiGuard Labs uncovered a corporate phishing campaign targeting Windows users that delivers VenomRAT v6 and other remote access trojans/stealers via obfuscated SVG attachments and ScrubCrypt-created batch files; the attack chain includes base64-embedded SVG payloads, unpacked ZIPs, BatCloak/PowerShell stages, AMSI/ETW bypasses, persistence mechanisms, C2 communication for plugin retrieval (Remcos, NanoCore, XWorm, and a crypto-wallet stealer), and published IOCs for detection and mitigation.