Revamped Remcos RAT Deployed Against Microsoft Windows Users

Fortinet researchers describe a phishing campaign that delivers a heavily obfuscated Remcos RAT by exploiting CVE-2017-0199 in unpatched Microsoft Office/WordPad documents; the attack uses multiple scripting layers (JavaScript, VBScript, PowerShell), Base64/URL encoding, fileless in-memory execution of the RAT, and anti-analysis techniques (ZwSetInformationThread, API hooking) to achieve remote control. Recommended defenses include patching Office, advanced email filtering, modern endpoint protections to detect suspicious PowerShell behavior, and regular user security awareness training.