Fast-Spreading, Complex Phishing Campaign Installs RATs

Fortinet Labs observed a global phishing campaign targeting Windows users across multiple sectors that lures victims to personalized spoof pages and delivers obfuscated JavaScript droppers (via UpCrypter) to deploy various RATs (PureHVNC, DCRat, Babylon RAT) and harvest credentials; the campaign uses anti-analysis techniques and in-memory execution, is rapidly growing, and defenders are advised to apply layered email/web/endpoint protections and PowerShell execution controls.