A sophisticated malware operation dubbed OBSCURE#BAT has been identified by Securonix researchers, utilizing social engineering tactics to deliver the open-source r77 rootkit to victims. This campaign primarily targets English-speaking users in the United States, Canada, Germany, and the United Kingdom.

## Attack Methodology

The attack begins with an obfuscated Windows batch script that executes PowerShell commands, initiating a multi-stage infection process. Researchers Den Iuzvyk and Tim Peck identified two primary infection vectors:

1. Fake Cloudflare CAPTCHA verification pages using the ClickFix strategy
2. Malware disguised as legitimate software including Tor Browser, VoIP applications, and messaging clients

While the exact distribution method remains unclear, experts suspect traditional techniques like malvertising or SEO poisoning are being employed.

## Technical Details

Once executed, the batch script deploys additional components that:
– Store obfuscated scripts in the Windows Registry
– Create scheduled tasks for persistence
– Register a fake driver (ACPIx86.sys)
– Deploy a heavily obfuscated .NET payload with anti-detection features including control-flow obfuscation, string encryption, and function names using mixed character sets
– Implement AMSI patching to bypass antivirus detection

The final payload drops the “ACPIx86.sys” system-mode rootkit into the Windows drivers folder and deploys the r77 user-mode rootkit, which hides files, processes, and registry keys matching the “$nya-” pattern. The malware also monitors clipboard activity and command history, storing this data in hidden files for potential exfiltration.

## Evasion Techniques

OBSCURE#BAT employs advanced evasion methods including:
– Process injection into critical system processes like winlogon.exe
– Registry manipulation
– Scheduled task persistence
– API hooking

This campaign coincides with other recent threats, including a Microsoft Copilot spoofing campaign designed to steal credentials and 2FA codes.