VHDX Delivery Chain Hides Remcos RAT via JavaScript Stage

2026-06-17 GIGATAP Team #security

#malware #remcos-rat #vhdx

Malicious ZIP distribution analyzed by SANS ISC shows a chain where a VHDX disk image is used as a container to expose JavaScript payload after automatic mounting on Windows, ultimately enabling Remcos RAT deployment. The risk is not a single exploit but abuse of file handling and user trust in disk images.

What changed#

A reported malicious archive (SHA256: a0104921a2d37ab87482ac9a9f5c3713479c118846c3e999178e75b81620c094) arrives as a ZIP file. Inside is a VHDX virtual disk image. On modern Windows systems, VHDX files can mount automatically or with minimal user interaction.

Once mounted, the disk reveals a JavaScript payload. That script is the execution layer that transitions the chain from passive storage to active compromise. The final payload observed in the chain is Remcos RAT, a remote access tool used for full system control.

The structure matters more than the individual components. ZIP hides VHDX. VHDX hides script. Script triggers execution. Each stage bypasses simpler static inspection.

Why does a VHDX delivery chain matter?#

It turns a storage format into an execution boundary bypass.

The abuse is not in VHDX itself but in how operating systems treat it as trusted infrastructure. Disk images are treated as neutral artifacts. That assumption breaks when they become carriers for active code.

The chain reduces visibility for endpoint tools that scan archives but do not fully inspect mounted virtual disks in real time.

Definition capsule:
VHDX is a Microsoft virtual hard disk format used to store full disk images that can be mounted as logical drives in Windows environments.

What to check in real environments#

Focus is not file type. Focus is mount behavior and secondary payload exposure.

ZIP archives containing disk image formats: VHDX, VHD, ISO
Automatic or user-initiated mounting events
Script execution originating from newly mounted drives
Unexpected JavaScript execution contexts outside browsers or development tools
Correlation between archive extraction and new drive appearance

Comparison table: common delivery layers#

Each layer is benign in isolation. The combination creates the attack path.

What not to overclaim#

No indication in the sample itself that VHDX is a vulnerability. The risk is operational, not a CVE class issue. The attack relies on default OS behavior and user or system-triggered mounting.

The technique is not novel in concept. It is a repackaging of multi-layer hiding used to delay inspection.

FAQ#

What is the core risk here?
Execution hiding behind a trusted disk image format that is automatically mounted and inspected too late in the chain.

Is VHDX itself unsafe?
No. The risk comes from how it is used as a container for executable content.

Can endpoint detection catch this?
Only if it monitors mount events and script execution inside newly attached virtual drives.

Crypto clipper adds Tor and worm-like spread to theft model - Microsoft analysis shows crypto clipper evolving into a persistent threat combining clipboard hijacking, Tor-based control, and worm-like propagation.
Fake ChatGPT Downloads Turn Search Into Malware Delivery - Malwarebytes warns that a fake ChatGPT download site serves malware to Windows and Mac users. The key check is download provenance, not a ChatGPT flaw.
Glassworm’s takedown shows the new C2 problem - Glassworm was disrupted after researchers cut off four C2 channels at once. The real lesson is how supply-chain malware used developer tools, blockchain, D
Fox Tempest shows why signed malware still matters - Microsoft says Fox Tempest ran a malware-signing service used by other criminal groups. The lesson is narrow but important: signatures help trust, but they
Supply-chain attacks become a leaderboard - TeamPCP and BreachForums are reportedly promoting a $1,000 contest for Shai-Hulud package compromises. The prize is small. The copycat incentive is the pro
BCI moves from trial to real use as AI national strategy expands - A brain implant user with ALS signals early real-world BCI use while South Korea accelerates national AI focus and infrastructure alignment.
Postinstall payloads in npm supply chains and Mastra breach - Mastra npm packages were compromised through a postinstall hook that executed during install, exposing CI/CD pipelines and developer environments to remote
Security beyond benchmarks: Microsoft MDASH moves to production - Microsoft’s MDASH moves from benchmark success into live engineering pipelines, embedding AI-driven vulnerability discovery directly into DevSecOps workflo

Latest articles

Crypto clipper adds Tor and worm-like spread to theft model - Microsoft analysis shows crypto clipper evolving into a persistent threat combining clipboard hijacking, Tor-based control, and worm-like propagation.
US Government AI Inventory Raises Privacy Questions - US agencies list 3,611 AI use cases, exposing gaps in transparency and raising questions about automated decision-making and privacy.
BCI moves from trial to real use as AI national strategy expands - A brain implant user with ALS signals early real-world BCI use while South Korea accelerates national AI focus and infrastructure alignment.
Canada’s Bill C-22 Pushes Encryption Toward Built-In Access Risk - Bill C-22 expands surveillance powers in Canada and introduces mechanisms that could force access paths into encrypted systems, raising structural privacy
Postinstall payloads in npm supply chains and Mastra breach - Mastra npm packages were compromised through a postinstall hook that executed during install, exposing CI/CD pipelines and developer environments to remote
Security beyond benchmarks: Microsoft MDASH moves to production - Microsoft’s MDASH moves from benchmark success into live engineering pipelines, embedding AI-driven vulnerability discovery directly into DevSecOps workflo
Wolf Gallery and the F-Droid packaging bottleneck - Wolf Gallery’s F-Droid request shows how strong local encryption and offline design still depend on packaging work before reaching users through trusted di
Schibsted Pay or Okay raises consent legality questions - Schibsted’s Pay or Okay rollout faces a complaint in Norway over whether paid opt-outs still count as freely given consent under GDPR.