Active HanGhost Loader Campaign Targets Enterprise Payment and Logistics Workflows

An active HanGhost loader campaign uses obfuscated JavaScript and hidden PowerShell to run a .NET in-memory loader that extracts encrypted payloads from images, delivering multiple malware families (PureHVNC, XWorm, Meduza, AgentTesla, Phantom and sometimes UltraVNC). The threat specifically targets finance and operations personnel to gain persistent remote access and steal or manipulate transactional and contractual data; the report recommends behavior-first triage (interactive sandboxing) and hunting based on execution chains rather than static indicators.