Netcrook
#Windows Script Host
When a Script Comment Becomes a Trap for AI Security Tools
A VBScript sample tied to GuardBreaker shows how untrusted text inside code comments can be used to confuse AI-assisted malware analysis without changing how the script runs.
The Trusted Remote Tool That Turned Into a Script Factory
Three related incidents show how a legitimate remote-support stack can be bent into a staged malware path, with VBScript used to reach newly connected hosts.
The Loader That Hid in Plain Sight: Malware Split Across 364 Windows Variables
A staged Windows chain used JScript, hidden PowerShell, and in-memory .NET execution to keep its payload off disk and harder to spot.
When the Attachment Is the Trap: A Windows Script Chain Built to Hide in Plain Sight
A phishing-laced loader is using archive-delivered JScript, PowerShell, and in-memory .NET execution to shrink the clues defenders usually depend on.
Old Malware, New Script Chain: Why LokiBot Still Fits Modern Windows Defense Gaps
A recent LokiBot campaign pairs obfuscated JScript with PowerShell, showing how native Windows scripting can still carry commodity credential theft past noisy perimeter controls.
When a RAR File Becomes a Delivery System for Windows Persistence
A targeted campaign tied to Ukraine’s UAV ecosystem shows how a booby-trapped archive, a script loader, and a decoy document can turn routine file handling into a foothold.
Trusted Chat, Untrusted Payload: How WhatsApp Messages Became a Windows Delivery Route
Compromised WhatsApp accounts are being used to push malicious VBScript files, then legitimate RMM tools are abused to keep access alive on infected Windows machines.
Windows Script Hosts and Tor: The Hidden Path in a Crypto Clipper Campaign
A Windows-based crypto clipper reportedly leans on WScript, ActiveXObject, and Tor, a combination that can blur the line between ordinary scripting and malicious automation.
Windows Scripting, USB Shortcuts, and Tor: The Hidden Machinery Behind a Crypto Clipper
Microsoft says a Windows-based cryptocurrency clipper has been active since February 2026, and its design leans on built-in scripting, shortcut abuse, and Tor-hosted command infrastructure.
Purchase-Order Traps Are Turning JavaScript Into a Quiet Enterprise Backdoor
A procurement-themed .js attachment can become a foothold on Windows, showing how a routine inbox task can turn into execution, persistence, and remote control.
Windows’ Old Script Host Is Back in the Dock as Stealers Ride In
MSHTA’s return to attacker toolkits shows how a trusted Windows component can still be used as a delivery path for commodity malware families such as LummaStealer and Amatera.
When a Retired Windows Relic Becomes the Delivery Truck for Stealers
MSHTA is not a zero-day exploit; it is a trusted Windows script host that attackers can abuse as a low-friction launch path for commodity malware.
Shortcut Traps and Script Lures Keep Working for Kimsuky’s Phishing Playbook
A reported campaign tied to Kimsuky shows how deceptively ordinary Windows file types can still carry real espionage risk when they arrive in a tailored email.