LoopDNS Dissects Phishing Email That Passed All Auth Checks | RAR5 Bait Deploys Remcos RAT via Process Hollowing
TL;DR
LoopDNS dissected a phishing email that passed SPF/DKIM/DMARC; a multi-stage attack chain ultimately injected Remcos RAT into calc.exe.
On July 23, 2026, LoopDNS's official mailbox received a phishing procurement RFQ email. LoopDNS's security team fully dissected the attack chain publicly, and one detail stands out: this email passed SPF, DKIM, and DMARC in full — but the attachment ultimately injected Remcos RAT into calc.exe.
Multi-stage attack chain: RAR5 file bait → inflated JScript → hidden PowerShell → image with appended data → reflective load → process hollowing into calc.exe. The sender domain
Key IOCs: Payload hosting domain
Zooming out: "all email auth passes" + "traditional procurement RFQ disguise" + "legitimate system process as host" — these three combined let this class of attack chain evade most enterprise email gateway static rules.
via LoopDNS Full Report
Multi-stage attack chain: RAR5 file bait → inflated JScript → hidden PowerShell → image with appended data → reflective load → process hollowing into calc.exe. The sender domain
trivantaholdings[.]com passed all three email authentication mechanisms, meaning the attacker either rented compliant commercial email infrastructure or directly took over a legitimate domain's sending config.Key IOCs: Payload hosting domain
deliverymailreport[.]co[.]za (IP 169.239.181.174); C2 domain kesmn[.]com (IP 46.151.182.181, TCP/2404); final Remcos SHA-256 4ccd1c3bf61ba55502624f95924672ca448b829e17e4ac7ad2a46d442bb716dd. Full hashes for the original attachment, JScript, .NET Loader, and two disguise images are in the original report.Zooming out: "all email auth passes" + "traditional procurement RFQ disguise" + "legitimate system process as host" — these three combined let this class of attack chain evade most enterprise email gateway static rules.
via LoopDNS Full Report