Cybercriminals Exploit VHD Files to Deploy VenomRAT and Steal Data

A new malware campaign is exploiting virtual hard disk (VHD) files to stealthily deliver VenomRAT. The attack begins with phishing emails posing as purchase orders, tricking users into opening an archive containing a VHD file. Once mounted, the VHD deploys a heavily obfuscated batch script that leverages PowerShell to execute malicious actions, stealing sensitive data and exfiltrating it to attacker-controlled C2 servers hosted on Pastebin.