The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
In August 2026, the VMRay Labs team has been focused on the following areas:
-
New VMRay Threat Identifiers addressing:
-
Detecting text files masquerading as images
-
Detecting tracking pixels in email
-
Detecting beaconing activity associated with Phorpiex variants
-
Detecting EvilProxy requests mimicking Microsoft credential discovery
-
Detecting batch and PowerShell scripts downloaded over HTTP
-
Detecting CAPTCHA activity associated with phishing campaigns
-
Detecting scripting tools connecting to suspicious top-level domains
-
Smart Link Detonation improvements:
-
New Configuration Extractors for:
-
Metasploit
-
AmateraStealer
-
+50 new YARA rules
Now, let’s delve into each topic for a more comprehensive understanding.
New VTIs
In a series of these blog posts, we introduced you to the concept of the VMRay Threat Identifiers (VTIs). In short, VTIs identify threatening or unusual behavior of the analyzed sample and rate the maliciousness on a scale of 1 to 5, with 5 being the most malicious. The VTI score, which greatly contributes to the ultimate Verdict of the sample, is presented to you in the VMRay Platform after a completed analysis. Here’s a recap of the new VTIs that we added, or improved in the past month.
Detecting text files masquerading as images
Category: Masquerade
MITRE ATT&CK® Technique: T1036/008
Malware may disguise a text file as an image to conceal its true purpose and make it appear harmless. For example, a file containing stolen email credentials might be saved with a .jpg extension even though its actual content is plain text.
This technique can help malware hide collected data on an infected system, blend it into legitimate files, or evade security controls that inspect files differently depending on their extension or reported type. An apparent image may receive less scrutiny than a text, log, or credential file.
Existing masquerading VTIs in the VMRay Platform primarily focus on executable files disguised as other file types. We have now extended this detection coverage with a new variant for apparent image files. The new VTI triggers when a process creates or downloads a file whose image extension does not match its type of content.
Detecting tracking pixels in email
Category: Heuristics
A tracking pixel is a tiny, usually invisible image embedded in an email. It is often implemented as a transparent 1×1-pixel image that is retrieved from a remote server when the recipient opens the message. This request can provide the sender with information such as:
-
Whether and when the email was opened,
-
The recipient’s approximate location based on their IP address, and
-
Details about the device, operating system, or email client used.
Tracking pixels are commonly used for legitimate purposes, such as measuring email campaign open rates. However, threat actors can also use them for reconnaissance, for example, to confirm that an email address is active or determine whether a potential target has opened a phishing email.
Our new VTI triggers when an analyzed email contains characteristics associated with a tracking pixel. Because tracking pixels also have many legitimate uses, this heuristic should be considered alongside the email’s content, links, and other detected indicators.
Detecting beaconing activity associated with Phorpiex variants
Category: Network Communication
MITRE ATT&CK® Technique: T1571, T1071
Beaconing occurs when malware repeatedly contacts an external server, typically a command-and-control (C2) server, to indicate that the infected system is active and ready to receive instructions. During these check-ins, malware may request commands or additional payloads, report information about the infected system, or transmit collected data. Although legitimate applications also make recurring network connections, for example, to check for updates, malware families often use distinctive destinations, communication sequences, or data formats.
Phorpiex is a long-running botnet whose variants regularly communicate with C2 infrastructure to receive updates. A recently analyzed sample that the VMRay Labs team encountered, made multiple consecutive requests to a specific C2 endpoint and exchanged data in a format associated with Phorpiex.
Our new VTI was added to cover this behavior. It triggers when a process repeatedly contacts the C2 server at a specific URL and exchanges data using a format known to be associated with Phorpiex variants.
Detecting EvilProxy requests mimicking Microsoft credential discovery
Category: Network Communication
During the Microsoft Entra ID sign-in process, a legitimate endpoint retrieving the credential type helps determine how a user should be authenticated. After the user enters an email address or username, Microsoft can use the request to identify the account type, locate the appropriate identity provider, and determine which authentication options to present. This process is known as Home Realm Discovery.
The request normally contains an account identifier, not the user’s password, and is not inherently malicious. Phishing kits can, however, imitate this behavior to determine how a targeted account authenticates and tailor the fraudulent sign-in flow accordingly.
During a recent analysis, we identified a script associated with the EvilProxy phishing kit that contained the credential type endpoint path. However, the request was directed to a non-Microsoft domain rather than the legitimate Microsoft service. Although the kit does not appear to make this request during every phishing session, the hardcoded path shows that the capability is present.
Our new VTI detects requests that use the Microsoft credential-discovery path on non-Microsoft infrastructure, a behavior associated with EvilProxy. It complements the existing Evil Proxy Suspicious Login Request VTI and provides additional evidence that a website may be imitating the Microsoft sign-in process to facilitate credential phishing.
Detecting batch and PowerShell scripts downloaded over HTTP
Attackers frequently divide an infection chain into multiple stages. Instead of including all malicious functionality in the initial file, they may use it to download a script that performs the next stage of the attack.
Batch and PowerShell scripts contain commands that Windows can execute to automate system operations. Although both formats are commonly used for legitimate administration, attackers can abuse them to modify system settings, establish persistence, collect information, or retrieve and execute additional payloads. Downloading such a script from an external server can therefore be an important indication of staged malicious activity.
Our new VTI triggers when a process downloads such scripts over an unencrypted HTTP connection. It extends the coverage of the existing Download EXE by HTTP VTI beyond executable files, helping analysts identify potentially dangerous script transfers earlier in the infection chain.
Detecting CAPTCHA activity associated with phishing campaigns
CAPTCHA challenges are intended to distinguish human users from automated systems. Phishing kits may imitate or incorporate them to make a malicious page appear more trustworthy, or prevent automated security scanners from inspecting the phishing content.
During a recent analysis of an Adobe Acrobat-themed phishing attempt, we observed a malicious page dynamically loading a CAPTCHA challenge. Its request pattern resembled behavior previously associated with Sneaky2FA, but contained enough differences to indicate that it originated from a different phishing kit.
This allows us to detect and report the observed activity without making an unsupported attribution, while also extracting additional indicators of compromise from the associated network traffic. Based on this analysis, we added two new VTIs:
-
One VTI for detecting the request used to retrieve the CAPTCHA challenge,
-
The second VTI for detecting the subsequent submission of proof that the CAPTCHA challenge was completed.
Together, these VTIs provide visibility into both stages of the CAPTCHA flow and help identify phishing infrastructure that might otherwise remain undetected.
Detecting scripting tools connecting to suspicious top-level domains
Category: Heuristics
MITRE ATT&CK® Technique: T1059
A top-level domain (TLD) is the final part of a domain name, such as .com, .org, or .click. Although a TLD alone does not make a domain malicious, some are disproportionately associated with phishing and other malicious activity.
VMRay already detects phishing domains that use TLDs frequently observed in malicious campaigns. During recent analyses, however, we identified multiple malicious PowerShell samples that connected to such domains to download additional payloads. This showed that combining the domain characteristic with information about the process initiating the connection can provide a stronger indication of suspicious behavior.
Our new VTI triggers when a scripting or command-line tool, such as PowerShell or Windows Command Shell, connects to a domain whose TLD is highly associated with phishing or other malicious activity.
Smart Link Detonation
Enhanced detonation of misleading email links
Attackers may disguise a malicious link in emails by displaying a familiar or trusted domain while embedding a different destination underneath it. For example, a link may appear to point to a legitimate service, but clicking it takes the recipient to an unexpected different location, ultimately displaying a phishing page.
We enhanced Smart Link Detonation (SLD) to provide more accurate analysis of these deceptive links. When the Link in email points to a different domain than its label claims VTI identifies a mismatch, SLD now submits the actual embedded destination, not the domain displayed in the link label, for recursive analysis.
Metasploit is a penetration-testing framework that threat actors often use, among other purposes, to create a so-called reverse shell, typically involving a loader component that downloads the next-stage payload from its C2 server.
AmateraStealer
Amatera Stealer is an information stealer based on ACR stealer. Amatera Stealer is sold in a “malware-as-a-service” model and is actively being developed. Several recent iterations of the payload have seen significant changes in terms of used cryptography.
YARA Rules Update
Our hunt for new, undetected malware samples never stops. In the past month, we added many fresh YARA rules to strengthen detection across a wide range of threats. This month, we’re continuing that momentum with 50+ new rules, focused on delivering a solid drop of high-quality detections. Here’s a quick preview of what we’re shipping this month.
New YARA detections for:
Spyware:
Botnet:
Wiper:
Loaders:
-
WabLoader
-
NICECURL
-
KlisatuLoader
RATs:
- LodaRAT
-
MilleniumRAT
-
EdgeRAT
-
HeroinRAT
Backdoors:
-
Blackbeard
-
UDPGangster
-
Phoenix
-
BugSleep/StealthCache
-
Beagle
-
TAMECAT
-
NightshadeC2
-
VShell
Ransomware:
-
Janaware
-
CRPxO
-
DeadLock
-
BXBDLocker
-
SuperboyKing
Phishing:
-
EvilProxy phishing
-
Phishing campaigns in the Middle-East
-
GoDaddy phishing
-
Improvements to EvilTokens YARA
-
Adobe Reader branded phishing pages
-
Phishkit.DocPR
Other:
New YARA signatures for:
