Malware · 91 days ago
A malicious ZIP can get past the first pass because the dangerous code does not show up until Windows auto-mounts the VHDX inside it. The handoff then uses WMI to start PowerShell, which looks less like a direct script-to-shell launch and can evade the parent-child rules many defenders depend on.
SANS says the sample hid a JavaScript loader inside the mounted disk image, then used obfuscation and a WMI-to-PowerShell chain to stage Remcos. The report says the disk-image trick and the launch path together help bypass email scanning, file scanning, and simple process-lineage detections.
The pattern is old, but the packaging matters. If attackers keep reusing auto-mounted disk images as a container, defenders may see the later stages first and miss the delivery path that matters most.
1 source covering this story
From a VHDX File to a Remcos RAT - SANS Internet Storm Center
From a VHDX File to a Remcos RAT, Author: Xavier Mertens
Part of the PlainSec briefing for 2026-06-16