Shadow#Reactor Uses Text Files to Deliver Remcos RAT

Shadow#Reactor is a multistage Windows malware campaign that uses text-only files to deliver the Remcos remote access Trojan, a technique described by researchers as a living-off-the-land style approach. According to Securonix, attackers gain initial access via social engineering and then a VBS launcher triggers a PowerShell downloader that retrieves fragmented, text-based payloads from a remote host, which are reconstructed into loaders via MSBuild, decoded in memory, and used to download Remcos.

The delivery chain relies on Windows Script Host to spawn PowerShell with unusually large inline command strings, and operates from user-writable directories such as Desktop or %TEMP%, minimising static indicators in the VBS file. The text-based payload is delivered in chunks, creating a download-and-validate loop so that defenders see text fragments rather than the final RAT.

Researchers note that Remcos is a commercially available tool often repurposed for malicious use, granting attackers complete control over a target system. The campaign appears financially motivated with broad, opportunistic targeting, and no single threat actor has been tied to it yet. January 13, 2026.