Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT
A new malspam campaign is leveraging Google's DoubleClick domain to bypass security detection and distribute the DesckVB remote access trojan (RAT). This method allows attackers to create scalable and cost-effective phishing operations.
Intelligence analysis by Gemini 2.5 Flash
Cybersecurity researchers have uncovered a malspam campaign that cleverly uses Google's legitimate DoubleClick advertising domain as a redirector. This technique helps the malicious emails evade security tools, leading victims to a personalized landing page that ultimately delivers the DesckVB RAT, a sophisticated .NET-based trojan designed for system control and data exfiltration.
Imagine a sneaky trickster sending you a fake email that looks real. Instead of sending you directly to a bad website, they send you through a super popular Google website first, like a hidden detour. Because it's Google, your computer doesn't get suspicious right away. Then, the trickster quickly makes a fake download page just for you, using your name and company. If you click a button there, a secret program called DesckVB RAT sneaks onto your computer and lets the trickster control it, like a puppet on strings, and steal your secrets. It's like a wolf in sheep's clothing, using a trusted path to get to you!
Analysis
Cybersecurity researchers from Huntress, specifically Anna Pham and Adam Mooney, have identified a novel malspam campaign exploiting Google's DoubleClick domain to deliver the DesckVB RAT. The attackers utilize DoubleClick as an initial redirector, a legitimate Google-owned domain that many security tools are less likely to flag as suspicious. This allows the malicious lure to route through trusted infrastructure before reaching attacker-controlled servers.
The campaign's unique aspect is its scalability. Instead of crafting individual lures for each target, a malspam kit dynamically personalizes the landing page using the victim's email address, company branding, and location details. This significantly reduces the operational overhead for the attackers.
The attack chain begins when a user opens an HTML file attached to a phishing email. This file triggers a meta-refresh browser redirect to a Google DoubleClick Campaign Manager click-tracking URL. From there, the victim is redirected again to a page that decodes their Base64-encoded email address and presents a landing page with a 'Download PDF' button.
Clicking this button downloads a ZIP archive, initiating the infection. A JavaScript loader within the archive retrieves and executes a PowerShell script, which then fetches a .NET loader from an external server. This .NET loader acts as a stager, performing anti-analysis checks, disabling security controls, establishing persistence, and finally deploying the DesckVB RAT payload using a technique called process hollowing, injecting the malware into legitimate Microsoft-signed processes.
Once active, the DesckVB RAT communicates with a command-and-control (C2) server via raw TCP sockets, conducts system reconnaissance, and configures Microsoft Defender exclusions. The trojan also patches Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) at the native API level to blind Windows telemetry before creating persistence through Run/RunOnce Registry entries and placing a loader in the user's Startup folder. The malware includes capabilities for data extraction, command execution, and additional payload deployment, granting attackers full control over compromised machines. It also incorporates anti-analysis measures, such as terminating and rebooting the machine if it detects analysis tools or sandboxed environments.
Huntress emphasizes the importance of 'defense in depth.' Recommendations include configuring Group Policy Objects (GPO) to force script files (like .vbs, .hta, .js) to open in Notepad by default, which can prevent initial payload execution. On the email security front, organizations should implement DMARC, DKIM, and SPF records to mitigate spoofed emails and deploy email gateway solutions with sandboxing capabilities for attachments and links.
Key points
- A new malspam campaign exploits Google's DoubleClick domain for redirection to evade security tools and deliver DesckVB RAT.
- The campaign uses a dynamic malspam kit that personalizes landing pages with victim details, making attacks more scalable and cost-effective.
- The DesckVB RAT is a .NET-based trojan that performs system reconnaissance, establishes persistence, and can bypass Microsoft Defender.
- Attackers utilize process hollowing to inject the malware into legitimate Microsoft-signed processes and patch AMSI/ETW to blind Windows telemetry.
- Defense-in-depth strategies are crucial, including GPOs for script file handling and robust email security with DMARC, DKIM, SPF, and attachment sandboxing.
The detection and detailed analysis of this new malspam campaign provide valuable intelligence for cybersecurity defenders. With this information, organizations can update their security policies, implement the recommended Group Policy Objects (GPOs), and enhance email security measures to better protect against similar sophisticated attacks in the future.
Despite the detailed analysis, the ongoing evolution of such sophisticated evasion techniques means that organizations and individual users will face a continuous challenge in keeping pace with attackers. The dynamic and scalable nature of this campaign, coupled with the malware's anti-analysis capabilities, suggests that DesckVB RAT could continue to pose a significant threat, requiring constant vigilance and adaptation from defenders.
