# Google DoubleClick Exploited in Sophisticated Malspam Campaign Delivering DesckVB RAT


Cybersecurity researchers have uncovered a new malspam operation that leverages Google's DoubleClick domain—a trusted Google-owned platform—to disguise malicious redirects and deliver DesckVB RAT, a sophisticated .NET-based remote access trojan. The campaign demonstrates how attackers are increasingly weaponizing legitimate infrastructure to bypass email filters and establish footholds in corporate networks with minimal detection.


## The Threat: DesckVB RAT Capabilities


DesckVB RAT is a .NET-based remote access trojan that emerged in the wild in February 2026. Once installed, the malware grants attackers comprehensive control over infected machines, enabling them to:


  • Extract sensitive data from compromised systems
  • Execute arbitrary commands with system privileges
  • Deploy additional payloads for lateral movement or persistent access
  • Disable security controls including Microsoft Defender
  • Establish persistence across reboots
  • Perform system reconnaissance to gather intelligence about the target environment

    • According to Huntress researchers Anna Pham and Adam Mooney, who documented the campaign, the trojan employs multiple evasion techniques to remain invisible to endpoint detection and response (EDR) tools and system administrators.


    ## Technical Details: The Attack Chain


    The malspam campaign begins with a deceptively simple delivery mechanism—a phishing email containing an HTML attachment. Here's how the infection chain unfolds:


    ### Step 1: Initial Redirect Through DoubleClick


    When a victim opens the HTML attachment, a meta-refresh browser redirect is triggered that routes traffic through Google's DoubleClick Campaign Manager, a legitimate ad tracking platform. Researchers noted that many security tools are less likely to flag traffic from Google-owned domains, making this an effective evasion technique.


    ### Step 2: Dynamic Lure Generation


    From the DoubleClick redirect, victims are passed to a malspam kit that personalizes the malicious landing page in real-time using the victim's email address. The kit dynamically pulls company branding, logo, and location information to create a convincing phishing page tailored to each organization—without requiring attackers to manually craft individual lures for each target.


    ### Step 3: Malicious ZIP Delivery


    Users encounter a "Download PDF" button. Clicking it triggers the server to respond with a ZIP archive containing the next stage of the infection chain.


    ### Step 4: JavaScript Loader and PowerShell Execution


    Inside the ZIP is a JavaScript loader responsible for:

  • Extracting a PowerShell script
  • Fetching a .NET loader from an attacker-controlled server
  • Executing the loader while evading behavioral detection

    • ### Step 5: Privilege Escalation and Security Evasion


    The .NET loader performs critical evasion and persistence operations:


    | Action | Purpose |

    |--------|---------|

    | AMSI patching | Disables Antimalware Scan Interface telemetry |

    | ETW patching | Disables Event Tracing for Windows logging |

    | Process hollowing | Injects RAT into legitimate Microsoft-signed processes |

    | GPO analysis | Detects sandbox/analysis environments |

    | Persistence setup | Creates Registry Run and RunOnce entries; places loader in Startup folder |


    ### Step 6: C2 Communication and Full Compromise


    Once established, DesckVB RAT communicates with command-and-control servers over raw TCP sockets, giving attackers real-time control over the compromised machine. The trojan begins system reconnaissance and configures Microsoft Defender exclusions to prevent future detection.


    ## Background and Context


    ### Why Legitimate Domains Matter in Evasion


    The use of Google's DoubleClick domain is strategically significant. DoubleClick is a widely trusted platform used by legitimate advertisers and marketing teams globally. Security teams often whitelist traffic to Google-owned domains, creating a blind spot that attackers exploit. By routing initial payloads through DoubleClick, threat actors ensure their malicious infrastructure doesn't trigger email gateway filtering or URL reputation scanners.


    ### Scalability Through Dynamic Personalization


    What distinguishes this campaign from typical phishing operations is its dynamic personalization at scale. Rather than crafting bespoke phishing pages for each target, the malspam kit automatically injects company logos, location details, and email-specific information on the fly. This reduces operational overhead while increasing success rates, making the attack model more economical and sustainable for threat actors.


    ### DesckVB's Growing Threat Profile


    DesckVB RAT has been in active circulation since February 2026, giving attackers four months to refine delivery methods, improve evasion techniques, and establish a customer base among cybercriminals. The sophistication of this latest campaign suggests the malware's capabilities have matured.


    ## Implications for Organizations


    ### Who Is at Risk?


    This campaign targets mid to large organizations across all sectors. The use of dynamic company branding suggests attackers are using corporate reconnaissance tools to identify targets and gather organizational intelligence before launching attacks.


    ### What Happens After Infection?


    Once DesckVB RAT gains a foothold, attackers can:

  • Harvest credentials for lateral movement
  • Access sensitive business data
  • Deploy ransomware or additional malware
  • Establish persistent backdoors for long-term espionage
  • Pivot to other systems on the corporate network

    • ### Detection Challenges


    The trojan's multilayered evasion techniques—including AMSI and ETW patching, process hollowing, and sandbox detection—make traditional endpoint detection extremely difficult. Organizations relying solely on behavioral signatures or log analysis may miss compromise indicators.


    ## Recommendations: Defense in Depth


    Security researchers and enterprise defenders should consider implementing the following controls:


    ### Email and Attachment Security


  • Deploy email authentication standards: Configure DMARC, DKIM, and SPF records to reduce spoofed and malicious emails reaching end users
  • Implement attachment sandboxing: Use email gateway solutions capable of detonating suspicious attachments and URLs in isolated sandboxes before delivery
  • Block executable attachment types: Consider blocking HTML, VBS, HTA, and JavaScript files at the email gateway
  • User training: Conduct regular phishing awareness training focused on recognizing social engineering tactics

    • ### Endpoint and Network Controls


  • Group Policy enforcement: Configure Group Policy Objects (GPO) in Active Directory to force script files (.vbs, .hta, .js) to open in Notepad by default, preventing accidental execution
  • Process hollowing detection: Deploy EDR solutions that can detect and alert on process hollowing and code injection techniques
  • Network segmentation: Isolate critical systems and limit lateral movement through microsegmentation

    • ### Detection and Response


  • Monitor C2 communications: Detect raw TCP socket connections to unknown external IPs during unusual hours
  • Registry persistence monitoring: Alert on suspicious additions to Run, RunOnce, and Startup folder modifications
  • PowerShell logging: Enable advanced PowerShell logging (Module, Script Block, and Transcription) to capture suspicious script execution
  • Threat hunting: Proactively search for AMSI and ETW patching attempts using custom detection rules

    • ---


    ## HackWire Analysis


    The abuse of Google DoubleClick in this malspam campaign reveals a critical reality: as email gateways become more sophisticated, attackers respond by weaponizing our trust in legitimate infrastructure. This isn't a flaw in Google's platform—it's a strategic pivot by threat actors who understand that security teams often apply less scrutiny to traffic originating from Fortune 500 companies.


    What makes this campaign particularly concerning is its scalability model. Previous phishing campaigns required manual customization for each target organization, limiting attack breadth. By automating company branding injection based on the victim's email domain, these attackers have essentially industrialized phishing. A small team can now target hundreds of organizations with personalized lures that require no additional effort beyond the initial infrastructure setup.


    The pattern here is worth noting: we're seeing attackers migrate toward "legitimate-looking" initial payloads. HTML files opened in browsers, JavaScript executing through Windows Script Host, PowerShell scripts—all are native Windows features that defenders struggle to restrict without degrading user productivity. The DesckVB RAT chain exploits this perfectly: each stage is technically "legitimate" code doing "legitimate" things, just in an illegitimate order.


    For defenders, the hard truth is that email security alone cannot stop this attack. A user can still be socially engineered into opening an attachment regardless of gateway filters. The recommendation to force script files into Notepad via GPO is excellent advice, but it's one of few truly preventative controls available. Beyond that, organizations need defense-in-depth: threat hunting for process hollowing, monitoring for AMSI/ETW patching, and behavioral detection tuned to catch the reconnaissance phase before full C2 establishment.


    The broader lesson: trust boundaries are shrinking. What was once considered a safe domain or file type is now weaponized. The future belongs to organizations that apply the same scrutiny to traffic from Google as they do to unknown IPs, and that assume every user-initiated action could be compromised.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Social Engineering](https://www.hackwire.news/category/social-engineering) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)