Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs

What happened

Malware campaigns that combine phishing (messages that impersonate someone to obtain passwords or money), obfuscated VBScript, PowerShell, and legitimate Windows applications to conceal infections targeting users in Brazil and Portugal. Hackers Use PowerShell and Windows Error Reporting to Hide Malware on Infected PCs, according to GBHackers.

The investigation covers Overlord RAT, Lampion, and an unidentified payload delivered through a malicious newdev.dll. cyber security Cyber Security News Malware 3 min. Rather than exploiting Windows Error Reporting itself, attackers impersonated its components and naming conventions, disguising malicious executables and scheduled tasks as routine operating system activity. The Overlord campaign impersonated Brazilian protest notaries, sending fraudulent legal notices containing links personalized with valid CNPJ business registration numbers. Instead of displaying documents, the links delivered VBS downloaders that retrieved executable or MSI payloads access . Scripts concealed strings using Chr() expressions or concatenation. Downloads originated from Dropbox and Google Cloud Storage, with curl used first and PowerShell serving as a fallback in several variants.