Google Double Click Abused in New Malspam Campaign to Deliver .NET Loader

Summary: Huntress researchers Anna Pham and Adam Mooney reported a malspam campaign that routes victims through Google's DoubleClick Campaign Manager click-tracking domain before reaching a kit that personalizes its lure using the victim's Base64-encoded email address, company branding, and location details. An attached HTML file triggers a meta-refresh redirect to a landing page whose "Download PDF" button returns a ZIP archive that starts a JavaScript loader, which runs PowerShell to fetch a .NET loader that disables security controls, patches AMSI and ETW, and delivers a RAT via process hollowing into Microsoft-signed processes.
Bottom line: The lure passes through a legitimate Google-owned domain that many security tools are less likely to treat as suspicious, and the kit builds a convincing page per target without operators handcrafting one - so the same chain scales across many organizations at once.

Read the original at The Hacker News ↗