SHADOW#REACTOR Malware Builds Remcos RAT via Text Files

According to Securonix Threat Research team, security researchers have uncovered SHADOW#REACTOR, a malware framework that slips past enterprise defences by hiding in plain sight and delivering the Remcos RAT through a multi-stage, fileless chain. The campaign uses “text-only intermediates”—harmless-looking text files such as qpwoe32.txt or config.txt—that contain fragmented payload pieces which are reconstructed in memory.

An obfuscated VBS launcher executed via wscript.exe invokes a PowerShell downloader, which retrieves the text-based fragments from a remote host and decodes them in memory by a .NET Reactor-protected assembly to fetch a Remcos configuration. The final stage leverages MSBuild.exe as a living-off-the-land binary to complete execution and deploy the Remcos backdoor, enabling control of the compromised system without touching the disk in a recognisable form.

Targets appear random, with a spray-and-pray approach rather than sector-specific lures, and attribution remains unattributed so far. The campaign highlights use of legitimate Windows tools and a shift towards in-memory, text-based payloads to evade detection. 15 January 2026