Phishing campaign targets Windows users with UpCrypter RATs

A rapidly expanding phishing operation targeting Windows users has emerged as a serious, multi-stage threat that goes beyond credential theft to deliver remote access tools and maintain long-term footholds inside corporate networks. The campaign uses personalized emails and convincingly branded fake websites to lure victims into downloading a JavaScript dropper that, in turn, deploys UpCrypter, a loader that installs a range of remote access tools. In just two weeks, detections have more than doubled, and the attack has reached organizations across manufacturing, technology, healthcare, construction, and the retail-hospitality sectors on a global scale.

At the core of the attack chain are highly tailored phishing pages. Victims are directed from emails that imitate missed calls or purchase orders to spoofed sites that display the recipient’s own company domain and logo. From there, users are coaxed into downloading a ZIP archive containing an obfuscated JavaScript file. When executed, the script triggers PowerShell activity and connects to attacker-controlled servers to retrieve the next payload. The technique’s sophistication extends to concealment tactics, including heavy...