SHADOW#REACTOR Campaign Uses Text-Only Staging to Deploy Remcos RAT

Securonix researchers describe the SHADOW#REACTOR campaign: a sophisticated, multi-stage Windows infection chain that uses obfuscated VBS to launch encoded PowerShell, repeatedly fetches text-hosted payload fragments which are reassembled and loaded reflectively by a .NET Reactor-protected loader, and abuses trusted Windows binaries (MSBuild.exe) to ultimately deploy the Remcos RAT in memory; defenders are advised to monitor script execution paths and outbound HTTP from scripting engines.