A phishing email disguised as a trucking rate confirmation is the opening move in a five-stage attack that disables Windows Defender with an open-source tool and installs a password-stealing remote access trojan, according to an infection-chain analysis published Monday.
Researchers Sean Shirley and Kyle Sopt of LevelBlue’s SpiderLabs Blog said the intrusion reflects a broader shift toward attackers chaining together publicly available tools rather than writing custom malware at every stage.
The lure, sent from loadofferstender@gmail.com with the subject line “DETROIT, MI to DALLAS, TX,” directs recipients to a fake confirmation portal at signindat[.]com. Clicking “Download Rate Confirmation” doesn’t deliver a PDF — it drops a batch file that launches hidden PowerShell with script-execution protections bypassed, patches Windows’ built-in antivirus scanning interface (AMSI) in memory, and downloads a first-stage executable, ElevatorShellCode.exe, which is written to %TEMP%\es.exe and run in a hidden window.
From there, the chain escalates privileges through a known Windows User Account Control bypass technique, then installs WinDefCtl — an open-source Microsoft Defender-disabling tool built by developer Marek Wesolowski — disguised as svchost.exe.
WinDefCtl then loads a signed kernel driver, a low-level program with direct control over the operating system, to shut down Defender’s processes outright. Only after defenses are down does the attacker install the main payload: CrySome RAT, a modular trojan that gives its operator persistent remote access, remote command execution, file management, system reconnaissance, keylogging and hidden virtual network computing.
“This intrusion shows how modern malware campaigns increasingly rely on publicly available tooling rather than bespoke malware at every stage,” Shirley and Sopt wrote.
The malware’s credential-theft function targets Chrome, Edge and Brave: it terminates the browser process, writes an embedded file called abe_decrypt.dll to disk, injects it into the browser, and exports saved passwords and cookies as JSON files. It reinstalls itself every five minutes through a scheduled task named “CrysomeLoader,” while the victim sees a convincing decoy PDF open on screen.
LevelBlue said the chain leaves specific traces defenders can hunt for: hidden PowerShell sessions launched with execution protections bypassed, in-memory script execution, new Defender exclusions added through PowerShell’s Add-MpPreference or Set-MpPreference commands, and svchost.exe running from a temp folder instead of its normal system path.
“From a defensive perspective, detecting the individual behaviors throughout the chain, rather than relying solely on malware signatures, provides multiple opportunities to disrupt the intrusion before the final RAT becomes established,” researchers wrote.
The freight-industry disguise fits a pattern federal investigators have flagged. The FBI’s Internet Crime Complaint Center warned in an April 30 public notice that cyber-enabled cargo theft cost U.S. and Canadian businesses nearly $725 million in 2025, a 60% jump from the year before, with attacks routinely starting the same way: a phishing email tied to a shipping or rate confirmation.
Image by Renee Gaudet from Pixabay
