Most of the attacks covered in this month's update don't rely on anything exotic. A one-pixel image confirms a mailbox is live. A CAPTCHA keeps security scanners away from a phishing page. A small PowerShell script does the real work after an innocent-looking first file. A text file full of stolen credentials sits on disk wearing a .jpg extension. Each step is cheap for the attacker and easy to miss for the defender, because each one borrows behavior that legitimate software uses every day.
In the September 2026 Detection Highlights webinar, VMRay Senior Security Product Manager Fatih A. and host Tucker Aldinger walked through what VMRay Labs shipped over the past month: seven new VTIs, a smarter way to detonate deceptive email links, two new config extractors and more than 50 new YARA rules. The session closed with a threat research case study showing how a single RedLine C2 indicator led to the infrastructure behind a spear-phishing and business email compromise (BEC) campaign against a maritime manufacturer.
7 New VTIs Mapped to the Attack Chain
VMRay Threat Identifiers (VTIs) flag threatening, suspicious or unusual behavior observed during analysis and score it from 1 to 5, with 5 being the most malicious. Those scores feed directly into the final verdict for a sample. This month VMRay Labs added seven new VTIs. Strictly speaking the platform gained eight, because the CAPTCHA detection ships as a pair.
Rather than presenting them as a flat list, the webinar grouped the new detections by where they sit in an attack. That framing matters for analysts: it shows which stage of an intrusion each detection gives you visibility into, and where the gaps used to be.
Before the Click
Three VTIs cover the email and the phishing page behind it: tracking pixels used for reconnaissance, CAPTCHA gates that hide phishing content from scanners, and EvilProxy imitating Microsoft home realm discovery.
Staging
Two VTIs cover the moment an attack pulls down more tooling: batch and PowerShell scripts downloaded over HTTP, and scripting tools reaching out to domains on high-risk top-level domains.
On the Host
Two VTIs cover what malware does once it has settled in: disguising stolen data as image files, and Phorpiex beaconing repeatedly to its command-and-control (C2) server.
Back at the Inbox
Smart link detonation now follows the real destination behind a deceptive link label, so recursive analysis takes the same path a victim would, all the way to the phishing page.
Before the Click: Tracking Pixels, CAPTCHA Gates and EvilProxy
Tracking pixels used for reconnaissance
A tracking pixel is a tiny, usually transparent 1×1 image embedded in an email. When the message is opened, the mail client quietly fetches the image from a remote server, and that single request tells the sender whether and when the email was opened, a rough location based on IP address, and which device, operating system or mail client was used. Marketing teams rely on this to measure open rates. Attackers use exactly the same trick to confirm an address is live or to check whether a target actually opened a phishing email.
Because tracking pixels have so many legitimate uses, the new VTI is a heuristic. Weigh it together with the email's content, its links and the other indicators in the report rather than treating it as a verdict on its own.
CAPTCHA gates on phishing pages
CAPTCHAs exist to tell humans from bots, and phishing kits have noticed. A CAPTCHA makes a page look more trustworthy, and it stops automated security scanners from reaching the content behind it. VMRay Labs observed this on an Adobe Acrobat-themed phishing page that loaded a CAPTCHA challenge dynamically before showing anything else. The two new VTIs give visibility into the CAPTCHA flow and the network traffic around it, which produces additional indicators of compromise (IOCs) and exposes the phishing content an automated scanner would otherwise never see.
A note on attribution: The request pattern on this page resembled the Sneaky 2FA phishing kit, but it was different enough to point to another kit. VMRay detects and reports the behavior without assigning a kit name the evidence can't support.
EvilProxy imitating Microsoft home realm discovery
In a normal Microsoft Entra ID sign-in, you enter your email address and Microsoft looks up how that account should authenticate: which identity provider it belongs to and which sign-in options to show. This lookup, called home realm discovery, carries only the account name, never the password, and is harmless on its own. EvilProxy, a well-known phishing kit targeting Microsoft sign-ins, copies the same lookup so it can tailor its fake sign-in page to the way a specific account authenticates.
VMRay Labs found this capability in a script tied to EvilProxy. It doesn't appear in every session, but it's there. The new VTI builds on the existing EvilProxy suspicious login request VTI and gives analysts one more piece of evidence that a site is imitating Microsoft to steal credentials. For more on how these signals combine, see VMRay's anti-phishing guide.
After the Click: Script Staging, Masquerading Files and C2 Beaconing
Attackers rarely put everything into the first file. The initial file often does very little itself; its real job is to pull down a batch or PowerShell script that changes system settings, sets up persistence, collects information or fetches further payloads. Once malware is on the host, its priorities shift to staying unnoticed and staying in touch with its operator. Four new VTIs cover these stages.
Script Download over HTTP
Extends the existing executable-download VTI to batch and PowerShell scripts. Because both are everyday admin tools, pulling one from an external server is a useful early warning sign that lets analysts stop the transfer earlier in the infection chain.
Scripting Tools Contacting High-Risk TLDs
A top-level domain alone doesn't make a domain malicious. What stood out was who was connecting: PowerShell and other command-line tools reaching high-risk TLDs to fetch the next payload. Maps to MITRE ATT&CK T1059.
Data Disguised as Image Files
In one analyzed case, stolen email credentials were saved as plain text inside a .jpg file, which hides collected data, blends in and draws less scrutiny from extension-based controls. Maps to T1036.008 (Masquerade File Type).
Phorpiex C2 Beaconing
Phorpiex, a long-running botnet, regularly checks in with its C2 server for updates and commands. A recently analyzed sample showed exactly this recurring communication. Maps to T1571 and T1071.
The common thread is context. PowerShell, high-risk TLDs, image files and periodic network check-ins all have legitimate explanations. The combination of tool, destination and behavior is what separates an attack from background noise, and that's what these detections are built to capture.
Smart Link Detonation and New Config Extractors
Following the link a victim would really click
It's an old trick that still works: the visible link text in an email shows a familiar, trusted domain, while the actual link underneath points somewhere else entirely, ultimately to a phishing page. VMRay already had a VTI that spots this mismatch between a link's label and its real destination. What's new is how smart link detonation responds. It now submits the real destination hidden behind the label for analysis, not the domain the label displays, so recursive analysis follows the same path a victim would take.
Metasploit and Amatera Stealer config extractors
Configuration extractors pull the embedded configuration out of a malware sample: C2 addresses, keys and other values the author built in. These are some of the most valuable indicators an analyst can get, because they can be pivoted on or turned into detection rules, and they often include infrastructure that never appears during dynamic analysis.
The first new extractor covers Metasploit, the penetration testing framework threat actors frequently use to create reverse shells, typically via a loader that downloads the next-stage payload from its C2 server. The second covers Amatera Stealer, an infostealer based on ACR Stealer, sold as malware-as-a-service and under active development. Several recent versions changed their cryptography significantly, which is exactly why a maintained extractor matters: extractors are specific to a family, variant and version, and have to evolve as the malware does.
50+ New YARA Rules Covering 54 Malware Families and Techniques
VMRay Labs shipped more than 50 new YARA rules this month, covering 54 malware families and techniques. Infostealers lead with 23 families, followed by eight backdoors, six phishing detections, five ransomware families, four remote access trojans (RATs), three loaders and three technique-based rules, plus a botnet variant and a wiper.
Among the infostealers are three macOS stealers, a reminder that Mac endpoints are firmly on the target list. The backdoors include NightshadeC2, the botnet coverage includes a Mirai variant, and the technique rules include PowerShell scripts padded with junk code to frustrate analysis. All of the rules are live in the platform today, and the full list is published in the September Detection Highlights blog post.
The volume reflects a broader shift the webinar called out: new families appear constantly, often recombining existing techniques. As the cost of copying a technique drops, partly thanks to AI, attributing activity to a specific actor gets harder, and broad, fast-moving signature coverage becomes more important.
Case Study: From One RedLine C2 to a Maritime Spear-Phishing Cluster
The second half of the session followed an investigation published on the VMRay blog. It's a strong example of why pivoting is worth the effort: the malware family that started the investigation turned out to be the least interesting part of the story. Every query used is included in the original blog post, so the whole investigation can be reproduced.
Steps 1–3: From a UniqueSignal indicator to a second RedLine C2
The starting point was a single RedLine C2 indicator from the VMRay UniqueSignal feed, listening on a non-standard, highly specific port. VirusTotal tied the IP to RedLine collections and to a cluster of communicating files, the earliest submitted in April 2026, recent enough to treat as live infrastructure. RedLine is a commodity infostealer sold as malware-as-a-service. Operation Magnus, led by the Dutch National Police, took down the RedLine and META back ends in October 2024, but leaked builds and repackaged variants still surface today.
Running one of the communicating samples in the VMRay Platform sandbox captured the C2 traffic. A SOAPAction header pointing at tempuri.org fits RedLine's SOAP-based communication and confirmed the family. For pivoting, the useful part was the pairing of the specific port with the server string Microsoft-HTTPAPI/2.0. That combination went into FOFA, which indexes internet-wide scan data, so the investigation never had to touch attacker servers. It returned two more hosts: one lined up with RedLine activity, the other showed nothing linking it to RedLine and was set aside.
Key insight: Microsoft-HTTPAPI is a generic Windows banner. A fingerprint is a starting filter, not a verdict. Check every hit before blocking it, because a false positive in a blocklist can do real damage.
Step 4: The second C2 leads to spear-phishing emails
Historical relations on the second C2 didn't reveal more RedLine. They revealed emails. The target was Kangrim Heavy Industries, a South Korean manufacturer of marine and industrial boilers with more than 60% of the world market. EML and MSG files submitted since January, all from South Korea, read like ongoing business conversations about shipments, with senders impersonating real companies in the maritime supply chain. The ZIP attachments delivered FormBook, a long-running form grabber and infostealer. Narrow targeting and industry-specific pretexts made this tailored spear-phishing, not spray-and-pray.
The sector and tactics overlap with what Sophos and EclecticIQ have reported for a group called GOLD GALLEON, but there was no overlap in infrastructure, tooling, certificates or victims, so the campaign remains unattributed.
Why follow the senders, not the malware
BEC is social engineering: the attacker poses as a trusted party such as a supplier, slips into a routine transaction and redirects a payment, often with no malware involved at all. According to FBI IC3 figures cited in the webinar, BEC caused $2.77 billion in reported losses in 2024 across more than 20,000 incidents, second only to investment fraud, and nearly $8.5 billion between 2022 and 2024. The payload in any single email is disposable and rotates quickly. The domains and mail servers that send those emails last much longer, so blocking them at the email gateway stops the next wave before it lands.
Steps 5–6: Separating attacker-owned domains and expanding the cluster
The campaign used five sender domains, and the first job was separating attacker-owned infrastructure from legitimate accounts that were spoofed or compromised. Pivoting on a real, compromised mail server just leads to another victim. Three domains had existed for years and belonged to real companies. One was harder to classify, though its recent passive DNS records were suspicious. The fifth, a lookalike registered in mid-2025 that impersonated a real maritime company, was the clearest case of attacker-owned infrastructure.
Looking that domain up in FOFA mostly returned Cloudflare, but one result showed the domain hosted with a smaller provider behind a specific Apache 2.4.62 and OpenSSL server banner. Neither attribute stands out alone; together they're selective. Querying that combination, then checking the TLS certificates of matching hosts for the same naming pattern, exposed seven more fraudulent domains set up for spear-phishing, each tied to its own IP. Most dated back to 2025 and two were recently active. The pattern was consistent: short names, several ending in "LLC", impersonating real businesses on TLDs such as .shop, .online and .top.
Key Takeaways for SOC and CTI Teams
The malware was the entry point, but the infrastructure was the story. The practical outcome of the case study is simple: block the seven domains and seven IPs at your email gateway. If any of them already appear in your mail, investigate those exchanges and rotate credentials for anyone who interacted with them. The full IOC list is in the blog post. More broadly, this month's updates point to four lessons.
Context Beats Single Signals
Tracking pixels, CAPTCHAs, PowerShell and image files are all normal in isolation. Detection value comes from combining behavior, tool and destination, then weighing heuristic VTIs alongside the rest of the report.
Look Behind the Gate
Phishing kits hide content behind CAPTCHAs and deceptive link labels specifically to defeat automated scanners. Analysis has to follow the path a real victim would take to see what's actually there.
Pivot on Durable Infrastructure
Payloads like RedLine and FormBook rotate quickly. Sender domains, mail servers and hosting fingerprints last longer, which makes them the more durable thing to block and hunt on.
Verify Every Fingerprint Hit
Server banners and port combinations are filters, not verdicts. Separate attacker-owned domains from spoofed or compromised victims before blocking, or you risk blocking the wrong party.
Every step of the case study started with one UniqueSignal indicator combined with the VMRay Platform. UniqueSignal draws on provider and industry partnerships, honeypots and spam-trap sensor networks, and delivers fresh IOCs labeled with malware family, runtime behavior and MITRE ATT&CK techniques in STIX/TAXII, MISP, JSON or CSV formats, straight into tools such as OpenCTI, ThreatConnect, EDR and SIEM platforms. For a limited time, UniqueSignal is available as a free 60-day trial.
Frequently Asked Questions
What are the new VMRay Threat Identifiers (VTIs) in September 2026?
VMRay Labs added seven new VTIs, eight counting the CAPTCHA pair. They cover tracking pixels in emails, CAPTCHA-gated phishing pages, EvilProxy imitating Microsoft home realm discovery, batch and PowerShell scripts downloaded over HTTP, scripting tools contacting high-risk TLDs, stolen data disguised as image files, and Phorpiex C2 beaconing.
Why is the tracking pixel VTI a heuristic?
Tracking pixels are used every day by marketing teams to measure email open rates, so their presence alone doesn't make an email malicious. Attackers use the same technique for reconnaissance, to confirm an address is live or see whether a phishing email was opened. Analysts should weigh the VTI alongside the email's content, links and other indicators.
How do phishing kits use CAPTCHAs to evade detection?
A CAPTCHA makes a phishing page look more trustworthy and prevents automated security scanners from reaching the content behind it. VMRay's two new CAPTCHA VTIs give visibility into the CAPTCHA flow and surrounding network traffic, surfacing additional IOCs and the phishing content that would otherwise stay hidden.
What is home realm discovery and how does EvilProxy abuse it?
Home realm discovery is the step in a Microsoft Entra ID sign-in where Microsoft looks up how an account should authenticate, using only the account name. EvilProxy copies this lookup so it can tailor its fake sign-in page to the way the victim's account authenticates, making the credential phishing page more convincing.
What changed in VMRay smart link detonation?
When an email link's visible label shows a trusted domain but the underlying link points elsewhere, smart link detonation now submits the real hidden destination for analysis instead of the displayed domain. Recursive analysis therefore follows the same path a victim would take, all the way to the phishing page.
Which new configuration extractors were added?
VMRay added config extractors for Metasploit, a penetration testing framework often abused to create reverse shells, and Amatera Stealer, an ACR Stealer-based infostealer sold as malware-as-a-service. Amatera's recent versions changed their cryptography significantly, which is why a maintained, version-aware extractor matters.
How many YARA rules did VMRay Labs release this month?
More than 50 new YARA rules covering 54 malware families and techniques, including 23 infostealers (three of them macOS stealers), eight backdoors, six phishing detections, five ransomware families, four RATs, three loaders, three technique rules, a botnet variant and a wiper. All are live in the VMRay Platform.
How did one RedLine C2 indicator lead to a maritime BEC campaign?
A RedLine C2 indicator from UniqueSignal was fingerprinted in the VMRay sandbox and searched in FOFA, revealing a second RedLine C2. Historical relations on that server exposed spear-phishing emails targeting a South Korean maritime manufacturer. Pivoting on an attacker-owned sender domain and its hosting fingerprint uncovered seven more fraudulent domains and their IPs.
Why pivot on sender infrastructure instead of the malware payload?
Payloads such as RedLine or FormBook are disposable and rotate quickly, while the domains and mail servers used to send phishing and BEC emails last much longer. Blocking attacker-owned sending infrastructure at the email gateway stops the next wave of emails, regardless of which payload they carry.
What is VMRay UniqueSignal?
UniqueSignal is VMRay's threat intelligence feed. It delivers fresh, unique IOCs labeled with malware family, runtime behavior and MITRE ATT&CK techniques in STIX/TAXII, MISP, JSON or CSV, for use in tools like OpenCTI, ThreatConnect, EDR and SIEM platforms. A free 60-day trial is available for a limited time.
Meet the Experts
Fatih A.
Senior Security Product Manager at VMRay | 8+ years in product management. Fatih leads the design, development and delivery of VMRay's detection capabilities, working with research and engineering teams to turn VMRay Labs findings into enterprise-ready security features.
Focus areas: Threat Detection, Threat Intelligence, Security Product Strategy
Tucker Aldinger
VMRay Events & Community Manager | Coordinates webinar series and community engagement to deliver the latest detection innovations and threat research to security professionals.
Focus areas: Threat Intelligence, Detection Innovation, Community Engagement
Turn One Indicator into the Full Picture
See how VMRay's new VTIs, YARA rules and config extractors surface deceptive links, credential phishing and script-based delivery, and how UniqueSignal helps you pivot from a single IOC to attacker infrastructure.
Start Your Free Trial Watch More Webinars