Fileless Remcos Attacks: Injecting Malicious Code into RMClient to Evade EDR

CyberProof researchers detected a significant surge in Remcos campaigns—Remote Control & Surveillance Software—through September and October 2025, using highly obfuscated PowerShell scripts and process hollowing into Microsoft’s RMClient.exe to achieve stealthy persistence and credential theft from Chromium-based browsers.

The attackers delivered a file via Microsoft Edge, and after extraction a batch file in the Temp directory launched an obfuscated PowerShell script with functions dubbed ‘Lotusblo’ and ‘Garrots’ to conceal its purpose, subsequently dropping the Remcos payload into RMClient.exe.

The dynamic payload retrieval used TLS 1.2 with a custom User-Agent to fetch Sluknin[.]afm from icebergtbilisi[.]ge, with the PowerShell loader performing Base64 decoding, GZip decompression, and execution via Invoke-Expression, while msiexec.exe was used to stage the next steps.

The fileless approach exploited the authentic RMClient binary—SHA-256 hash 8f6a3b111f6e0498cb677b175966175bfa53e58c9fb41ddb63c7b7568e24c760—to mask activity, with initial C2 connections to icebergtbilisi[.]ge; later activity included random file drops in the Temp directory and detected attempts to access saved credentials.

CyberProof shared a Kusto Query Language (KQL) hunting query to help defenders isolate RMClient.exe launched from temporary folders and highlighted the need to bolster behavioural monitoring and memory scanning as detection evolves. The investigation notes that attackers may have compromised legitimate websites to host payloads, and updates to detection rules and threat intelligence feeds are expected as indicators emerge.