Attackers Using Obfuscation Tools to Deliver Multi-Stage Malware via Invoice Phishing

Researchers observed an active, multi-stage phishing campaign that uses SVG attachments and layered obfuscation (BatCloak and ScrubCrypt) to deploy Venom RAT (and other RAT families) plus a stealer targeting cryptocurrency wallet files; the campaign employs persistence, AMSI/ETW bypasses, and a plugin-based C2 delivery mechanism to expand capabilities and exfiltrate sensitive data.