VIPKeylogger

VIPKeylogger is a Windows credential-stealing malware family commonly distributed through malspam and phishing campaigns that use business-themed lures such as orders, requests, quotes, invoices, shipping notices, payments, and offers. It has been observed in multi-stage infection chains using script-based droppers and loaders including VBScript, JavaScript, PowerShell, AutoIT, NSIS-wrapped payloads, shellcode loaders, and GuLoader-style delivery. Reported campaigns have used techniques such as hidden PowerShell execution via WMI, reflective in-memory loading of .NET assemblies, steganographic payload staging, and process injection or hollowing into legitimate Windows binaries to evade detection.

VIPKeylogger is associated with password-stealing activity and has been described as a variant or rebrand of SnakeKeylogger, also known as 404 Keylogger, in some campaigns. Observed functionality includes theft of credentials and other victim information, keylogging, reconnaissance of victim systems and external network identity, persistence through startup items and scheduled tasks, and exfiltration of collected data. Exfiltration channels documented for VIPKeylogger include SMTP and Telegram, with some campaigns using dual-channel exfiltration for redundancy and real-time operator notification.

The malware has been repeatedly observed targeting organizations and users through opportunistic phishing, including campaigns aimed at Italian businesses and other business users with localized lures, as well as tax-themed social engineering in Vietnam. Delivery chains have included archive attachments, script files, and disguised executables. In analyzed intrusions, VIPKeylogger has used defense-evasion measures such as obfuscation, anti-analysis checks, encrypted or XOR-encoded payload stages, and process injection into legitimate Windows processes. Overall, VIPKeylogger is best characterized as a commodity Windows infostealer/keylogger used in financially motivated phishing operations.