Mirage2FA phishing kit, Defender BTR abuse and 65+ new YARA rules

Detecting runtime payload compilation

Some malware does not carry a finished payload. Instead, as in this case, it brings C# source code and uses the Windows .NET compiler, csc.exe, to build the payload on the infected machine. This can make the malware harder to detect before the payload is built, because security tools may be looking for recognizable compiled files. It does not guarantee that the malware will evade detection, but it can make the compiled payload less visible during initial file scanning.

Our new Windows VTI detects when csc.exe, the C# compiler, compiles a new .NET file. Developers also use csc.exe to compile legitimate applications, so its use alone does not mean that a process is malicious. The VTI detects this use of csc.exe as part of suspicious activity.

New VTIs to detect Mirage2FA phishkit

Mirage2FA is an active commercial phishing kit that is primarily distributed through email. It targets Microsoft 365 users by stealing their session credentials. Following extensive research by our Labs team, we added several VTIs to detect behaviors associated with the kit.

One VTI detects the download of obfuscated JavaScript that Mirage2FA uses to build the final fake Microsoft login page. Another VTI detects the download of custom CSS, which some campaigns use to add styling to the page.

We also added detections for CAPTCHA-related behavior observed in one Mirage2FA campaign. When the page loads, it retrieves a token from the backend server. After the visitor clicks the CAPTCHA checkbox, the page sends the token back to the server for verification. The Mirage2FA Token Retrieval and Mirage2FA CAPTCHA Verification VTIs now effectively detect these steps.

Detecting abusing known web hosters used for redirections

Attackers sometimes use familiar website-hosting services to send people to phishing pages. In a recently analyzed sample, a Google sites page contained no meaningful content, only a link to a separate phishing page.

This can be suspicious because the hosting page acts as a stepping stone. Its familiar web address may make the first link seem trustworthy, even though it leads somewhere else. A page with only one link is not necessarily malicious, but when that link leads to a phishing page, the pattern is obviously a warning sign.

Our new VTI detects when a page on a known hosting service is used only to send visitors to another web address. For example, it can identify a Google sites page whose only purpose is to direct visitors to a separate destination.

Detecting potential abuse of the Windows Defender Boot-Time Removal driver

The Windows Defender Boot-Time Removal (BTR) driver is a legitimate Microsoft component designed to remove malware that cannot be deleted while Windows is running, for example, because a malicious file is currently in use or locked by another process. In such cases, Microsoft Defender schedules the removal for the next system restart. During startup, the BTR driver operates with elevated system privileges, allowing it to delete malicious files or modify registry entries before Windows fully loads.

However, this legitimate functionality can also be abused by attackers. In August 2026, Check Point researchers demonstrated how the BTR driver could be manipulated to perform unauthorized operations with high system privileges. For example, attackers could use it to delete files belonging to antivirus or endpoint security solutions, modify registry settings to weaken security protections, or remove evidence of malicious activity. Such operations could help attackers evade detection, disable security tools, or maintain access to a compromised system.

To help identify this type of abuse, we introduced a new Windows VTI that monitors suspicious activity associated with the BTR driver, including the use of NTFS Alternate Data Streams (ADS), which the driver uses to receive instructions for file and registry operations.

Detecting PyUltimateStealer behavior

PyUltimateStealer is an infostealer malware that targets sensitive data, including stored browser credentials. Its internal modules exhibit behaviors such as scanning process memory for credentials, attempting to retrieve Chromium’s master key, and accessing Firefox password data. Other notable activities include establishing persistence and searching for cryptocurrency wallets.

VMRay’s Labs team has broken down these behaviors into individual detections. Bringing these observations together helps analysts connect individual activities to a characteristic pattern associated with this stealer’s characteristic module.