AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign

LevelBlue SpiderLabs observed a global multi-stage phishing campaign (June 10–23, 2026) using macro-enabled Excel attachments and HTA/PowerShell staging to deliver commodity remote access trojans (Remcos, AsyncRAT) and potentially other infostealers; the report details obfuscation methods, Cloudflare Workers-based staging, fileless execution techniques, representative IOCs, and mapped MITRE ATT&CK techniques to support detection and hunting.