Can you use too many LOLBins to drop some RATs?

Malwarebytes reports a campaign that uses LOLBins to deploy two remote access tools: Remcos and NetSupport Manager, with attackers relying on Windows built-in utilities to hide their activity. The infection chain starts with forfiles.exe launching mshta, a technique used to evade detection before pulling a remote HTA file that spawns a PowerShell one-liner to download a tainted payload disguised as a PDF.

The payload is a trojanised Glaxnimate that, once executed, leads to staging in ProgramData and the eventual unpacking of the NetSupport RAT and its helpers through a series of scripted steps. Persistence is achieved by a registry modification via UserInitMprLogonScript to ensure the RAT runs at login, while the attackers continue to abuse legitimate tools like tar, curl, and WSH to avoid raising alarms.

The analysis highlights that, despite heavy LOLBin use, Malwarebytes is able to detect and block the attack, including the attacker’s IP address and the Remcos and NetSupport tools, according to Malwarebytes. 21 January 2026.