Fileless Remcos RAT Attacks: The Invisible Threat Hiding in Your Memory

A New Breed of Stealthy Cyberattacks

Cybercriminals are getting sneakier and their latest trick involves deploying malware without leaving a trace on your hard drive. Recently, security researchers uncovered a sophisticated attack using PowerShell-based shellcode loaders to deliver Remcos RAT, a notorious remote access trojan. Unlike traditional malware, this attack runs entirely in memory, making it nearly invisible to standard antivirus tools.

So, how does it work? Let’s break it down.

The Attack Chain: From ZIP Files to Full System Control

The campaign starts with a classic social engineering trick: tax-themed phishing emails. Victims receive a ZIP file disguised as an important document (think “Tax_Refund_2025.zip”). Inside? A malicious LNK (Windows shortcut) file the kind you’d normally click without a second thought.

But this isn’t just any shortcut. When opened, it triggers mshta.exe, a legitimate Microsoft tool meant for running HTML applications (HTA). Instead of launching a harmless app, it fetches an obfuscated HTA file (“xlab22.hta”) from a remote server.

This HTA file does three things:

1. Downloads a PowerShell script (the real weapon).

2. Drops a decoy PDF (to keep victims unsuspecting).

3. Creates a Registry entry to auto-launch another malicious HTA (“311.hta”) at startup.

Once the PowerShell script runs, it decodes a shellcode loader that injects Remcos RAT directly into memory no files written to disk.

Why Remcos RAT Is So Dangerous

Remcos RAT isn’t new, but its fileless delivery makes it a nightmare to detect. Once installed, it gives hackers full remote control over infected machines. Here’s what it can do:

• Log every keystroke (passwords, credit card numbers, you name it).

• Hijack webcam and microphone (yes, they can spy on you).

• Steal clipboard data (copied passwords, crypto wallet addresses).

• List all installed apps and running processes (to plan further attacks).

To stay hidden, it communicates with its command-and-control (C2) server (“readysteaurants[.]com”) via TLS encryption, blending in with normal web traffic.

Fileless Malware: The Ultimate Evasion Tactic

This isn’t the first time Remcos RAT has gone fileless. In late 2024, Fortinet spotted a similar campaign using fake order confirmations as bait. The trend is clear: Attackers are ditching traditional malware files for memory-only execution.

Why? Because most security tools scan files on disk not running processes in memory. By the time defenders notice, the malware has already done its damage.

How to Protect Yourself

Since traditional antivirus struggles with fileless attacks, you need layered defenses:
Never open unexpected ZIP/LNK files even if they look legit.
Disable macros and HTA execution in Windows (unless absolutely needed).
Use advanced email filtering to block malicious attachments.
Monitor PowerShell activity for suspicious scripts.

As J Stephen Kowski (SlashNext) warns:

“Fileless malware bypasses conventional defenses. Real-time PowerShell scanning and AI-driven email security are now essential.”

The Bigger Picture: More Malware, More Problems

This Remcos RAT campaign isn’t alone. Researchers also uncovered:

• A .NET loader spreading Agent Tesla, XWorm, and VIPKeylogger.

• Trojanized KeePass installers stealing password databases.

• PDF-based attacks pushing Lumma Stealer.

• Phishing emails using blob URIs to steal Outlook/Gmail logins.

Worse, AI-powered phishing is making attacks even harder to spot. Cybercriminals now use polymorphic techniques changing email subjects, sender names, and content dynamically to evade filters.

Final Thoughts: Stay Alert, Stay Safe

Fileless malware is the future of cybercrime and traditional security tools aren’t enough. By combining user awareness with advanced threat detection, you can stay one step ahead.