The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
In May 2026, the VMRay Labs team has been focused on the following areas:
1) New VMRay Threat Identifiers addressing:
-
Detecting suspicious Office controls
-
Detect attempts to evade Windows Defender
-
New VTI set combining different heuristics to identify phishkit behavior
-
Detecting PowerShell execution from environment variables
-
Detecting phishing pages downloading remote management tools
2) New or updated Configuration Extractors for:
-
ArechClient2/SectopRAT
-
Gh0stRAT
3) +30 new YARA rules
Now, let’s delve into each topic for a more comprehensive understanding.
New VTIs
In a series of these blog posts, we introduced you to the concept of the VMRay Threat Identifiers (VTIs). In short, VTIs identify threatening or unusual behavior of the analyzed sample and rate the maliciousness on a scale of 1 to 5, with 5 being the most malicious. The VTI score, which greatly contributes to the ultimate Verdict of the sample, is presented to you in the VMRay Platform after a completed analysis. Here’s a recap of the new VTIs that we added, or improved in the past month.
Detecting suspicious Office controls
Category: Heuristics
Microsoft Office documents can contain embedded controls: interactive objects inside Word, Excel, or PowerPoint files. Common examples include buttons, checkboxes, text boxes, scroll bars, and embedded objects. From a security perspective, the most relevant controls are often ActiveX controls and OLE objects.
ActiveX Controls
ActiveX controls are COM-based components that Office documents can embed or reference. They are commonly used to add interactive functionality, such as buttons, forms, media players, or custom objects. For example, an Excel spreadsheet may contain a button that triggers VBA code when clicked.
OLE Objects
OLE stands for Object Linking and Embedding. It allows Office files to embed or link to external objects, such as another Office document, a package, a PDF, or an object handled by another application. In malicious Office documents, OLE objects may be used to hide payloads, trigger external application behavior, or exploit vulnerable object handlers.
Our new VTI context
During sample analysis, the VMRay Platform extracts controls from Office files and identifies whether any of them are associated with known vulnerabilities. This information is valuable because vulnerable controls can indicate that a document is attempting to exploit a specific Office-related attack vector. However, this information can be difficult to find manually, especially when controls are embedded deeply inside a document structure.
To make this behavior more visible, we improved our VTI to detect suspicious Office controls.
Detect attempts to evade Microsoft Defender
Category: Defense Evasion
MITRE ATT&CK® Technique: T1497
NtIsProcessInJob is a low-level Windows API function that checks whether a process is assigned to a job object. This specific API could be used by malicious samples to detect whether they are running inside the Windows Defender emulator. Since emulators are typically incomplete and only implement the most relevant functionality, they often expose artifacts that can be used for detection.
In this case, the sample checks for specific return values from the API call to determine whether it is currently being emulated. Based on the result, it can alter its behavior to evade detection or reveal its actual behavior.
This technique has also been observed in SquidLoader samples. Trellix researcher Charles Crofford described SquidLoader’s use of it as a Windows Defender emulator detection method, implemented alongside other anti-analysis and anti-sandbox checks. To improve visibility into this behavior, we added a new VTI that triggers when a process tries to detect the presence of Windows Defender emulator using NtIsProcessInJob.
We added a new VTI that combines several behavioral heuristics to identify phishkits based on page structure and background traffic. This detection is implemented as a meta VTI, correlating multiple smaller signals into a broader classification. Individually, these behaviors may appear legitimate. However, when observed together, they can indicate that a sample is behaving like a phishing kit.
Below is a breakdown of the latest individual VTIs:
-
Microsoft password-reset page indicators.
The first VTI looks for cases where a sample contains or interacts with the legitimate Microsoft password-reset node. A node in this context is an observed item in the sandbox’s behavior graph. It can represent UI text, a web page element, a URL, or another object seen during analysis. It becomes suspicious when an unknown or malicious sample tries to open, embed, or manipulate the original password reset node.
-
Line-broken login text.
The second VTI looks for text blobs on web pages that contain many line breaks together with login-related keywords. These expressions are not malicious on their own and appear in many legitimate applications. However, when they appear together in a dense, line-broken text block inside a suspicious sample, they may indicate a phishing page template or credential-harvesting form.
-
Connections to Microsoft authentication services.
The third VTI looks for connections to Microsoft authentication-related infrastructure. Such connections are legitimate and commonly used by Microsoft services, browsers, Office applications, Teams, and other enterprise tools. The suspicious part is the context: if an unknown sample or phishing artifact connects to Microsoft authentication services without a clear reason, it may be interacting with a real Microsoft sign-in flow. In a phishkit scenario, this behavior may be linked to credential harvesting, MFA bypass attempts, token capture, or account takeover preparation.
-
EvilProxy-specific VTI.
Together, the individual VTIs described above expose valuable indicators that improve our ability to detect EvilProxy-style activity more reliably.
Detecting PowerShell execution from environment variables
Category: Defense Evasion
In PowerShell, environment variables are key-value pairs that store system-level data. This often includes data such as:
USERNAME
COMPUTERNAME
TEMP
APPDATA
