Sophisticated Multi-Stage Malware Campaign Weaponizes Legitimate Cloud Services

A sophisticated new malware campaign has emerged, utilizing a blend of advanced obfuscation and multi-stage delivery mechanisms designed specifically to slip past modern, signature-based security perimeters. According to recent forensic analysis from Joe Sandbox, the threat actors behind this operation are moving away from “loud” malware in favor of living-off-the-land techniques that blend seamlessly into enterprise environments.

The campaign’s initial entry point relies on highly tailored spear-phishing tactics. Targeting employees at the Punjab Safe Cities Authority (PSCA) and PPIC3 in Pakistan, the attackers use social engineering to exploit organizational trust. By impersonating an internal consultant and referencing a specific, credible infrastructure project dubbed the “Safe Jail Project,” the attackers create a psychological “hook” that increases the likelihood of victim engagement. The emails are further bolstered by high-priority markers and read-receipt requests to create a sense of professional urgency.

The infection vector is bifurcated, utilizing two distinct malicious attachments: a Word document titled “CAD Reprot.doc” and a PDF named “ANPR Reprot.pdf.” Interestingly, the attackers utilize intentional typos in the filenames—a common tactic used to mimic the perceived “rushed” nature of internal administrative communications, thereby lowering the victim’s suspicion.

Technical Analysis: The Multi-Stage Infection Chain

The malware’s execution flow is a masterclass in layered persistence. The Word document serves as the primary dropper, containing a VBA macro that remains dormant until the user explicitly enables content. Once triggered, the macro utilizes the IServerXMLHTTPRequest2 object to pull a malicious payload, code.exe, from a domain hosted on BunnyCDN. This leverages the reputation of a legitimate Content Delivery Network (CDN) to bypass domain-reputation filters.

To thwart static analysis, the macro employs VBA stomping. This technique involves manipulating the compiled P-code within the document to hide malicious logic from security scanners that only inspect the high-level source code. This ensures that even if a file is scanned, the true intent of the macro remains obscured.

Simultaneously, the PDF attachment provides a secondary, highly deceptive infection route. It presents a fraudulent Adobe Reader error, prompting the user to “Update PDF Reader.” This interaction triggers a drive-by download of a malicious ClickOnce application named “Adobe.application.” This application then fetches a secondary payload, disguised as “Adobe.exe,” creating a redundant infection path that complicates remediation efforts.

Command-and-Control (C2) and Exfiltration via Trusted Ecosystems

Perhaps the most alarming aspect of this campaign is its strategic weaponization of legitimate developer and communication tools to establish Command-and-Control (C2) channels. Once code.exe is active, it utilizes Microsoft Visual Studio Code tunnel services to establish a persistent, encrypted connection. By routing traffic through VS Code tunnels, the malware’s communication parameters appear as legitimate developer activity, making it incredibly difficult for network security monitoring (NSM) tools to distinguish between a programmer working remotely and an attacker maintaining access.

For data exfiltration, the payload leverages Discord webhooks. Instead of communicating with a known malicious IP address, the malware sends execution status updates and stolen data directly to attacker-controlled Discord channels. This “Living off Trusted Services” approach effectively neutralizes traditional defenses that rely on blacklisting suspicious domains.

Evasion and Persistence Tactics

The campaign employs a suite of advanced evasion techniques to maintain a low profile:

• Environmental Awareness: The malware executes tasklist.exe to perform process enumeration, checking for the presence of sandbox environments or security agents before proceeding.
• Trust Exploitation: It utilizes unsigned ClickOnce manifests with null public key tokens, allowing it to bypass certain Windows trust and integrity checks.
• Deceptive Branding: Through typosquatting and the use of Adobe-themed UI elements, the malware exploits human psychology to bypass visual scrutiny.
• Infrastructure Camouflage: By utilizing CDNs and legitimate cloud-based C2 services, the attackers minimize their footprint on traditional reputation-based threat intelligence feeds.

Conclusion and Mitigation Strategies

Security analysts have assigned this sample a 100/100 malicious score, with a 95% confidence level, supported by corroborating detection from VirusTotal, Suricata, Sigma, and YARA rules. The sheer technical depth of the payload delivery leaves virtually no room for false positives.

This campaign serves as a critical reminder that traditional perimeter defenses are no longer sufficient. As threat actors increasingly exploit the “trust” inherent in tools like VS Code and Discord, organizations must shift toward a Zero Trust architecture and Behavioral Detection capabilities. We recommend the following immediate actions:

• Disable Macros: Enforce strict Group Policy Objects (GPOs) to disable VBA macros by default across the enterprise.
• Monitor Developer Tools: Implement heightened monitoring for unusual outbound connections originating from developer-centric tools like VS Code tunnels.
• Endpoint Behavioral Analysis: Deploy EDR (Endpoint Detection and Response) solutions capable of identifying anomalous process behaviors, such as a Word document spawning a network request to a CDN.
• Network Segmentation: Restrict the ability of non-essential applications to communicate with public webhook services or unauthorized CDNs.