Snake Keylogger Uses Weaponized Emails and PowerShell to Steal Sensitive Data

A newly observed information-stealing campaign is deploying a stealthy variant of the SnakeKeylogger malware via weaponised e-mails that masquerade as legitimate remittance advice from CPA Global and Clarivate. According to GenThreatLabs, the infection vector first appeared on 7 October 2025, with recipients invited to download an attached ISO or ZIP file containing a malicious BAT script.

The analysis shows the malware leverages embedded PowerShell commands to fetch the SnakeKeylogger payload, execute it, and exfiltrate harvested credentials to attacker-controlled infrastructure, with a social engineering angle that uses spoofed sender aliases such as “CPA‑Payment Files” and display names referencing CPA Global or Clarivate.

When run, the BAT script silently invokes a PowerShell one-liner to download loader.exe and launch the implant, and the campaign uses ISO containers to bypass ZIP-scanning policies. The exfiltration is performed over HTTP POST, and persistence is achieved via a scheduled task named “SysUpdate” that triggers hourly, enabling ongoing credential theft and data leakage.