Unit 42 TTI (Oct 13): a phishing email gets the victim to install a client for an attacker-registered trial tenant of a legitimate RMM product. Operators then use PowerShell to fetch (1) a signed Caphyon Advanced Installer VmLauncher.exe that side-loads a Delphi DLL renamed zlibai.dll (decoy zlib exports, entry-point patching, XOR-encrypted command strings) and (2) an unpacked MV3 extension loaded via the browser command line. The extension has no update URL and requests cookies, scripting, tabs and webNavigation on all URLs. It reads its WebSocket C2 from a dead-drop text file and captures form fields (passwords unconditionally), cookies and screenshots, and injects HTML overlays. Targets are about 65 Portuguese/Brazilian banks plus 11 crypto exchanges. Key IOCs: n1.youconnectedssl[.]digital/pt.txt, euromasterx[.]com, xdrivewin[.]com, 216.203.21[.]119, 190.2.184[.]201.

// KQL sketch (MDE): signed host loading fake zlib, browsers with --load-extension
DeviceImageLoadEvents
| where InitiatingProcessFileName =~ "VmLauncher.exe" and FileName =~ "zlibai.dll"
| union (DeviceProcessEvents
  | where FileName in~ ("chrome.exe","msedge.exe","brave.exe")
  | where ProcessCommandLine has "--load-extension"
  | where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe","cmd.exe"))
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName