Malspam Campaign Uses DoubleClick Redirects to Deliver .NET Loader

A sophisticated malspam campaign discovered by the Hunterss exploits Google’s DoubleClick ad-tracking infrastructure to bypass email security gateways before deploying a multi-stage.

According to Hunterss, initial access begins with a malicious HTML attachment Bestellung_2026.html (“order” in German) containing a zero-second meta-refresh redirect to a legitimate ad.doubleclick[.]net click-tracking URL.

Because DoubleClick is a high-reputation Google-owned domain, most email gateways and URL reputation services pass it without inspection. What makes the delivery kit particularly scalable is its on-the-fly personalization.

Once redirected, the lure page reads the victim’s email address from the URL fragment, extracts the employer’s domain, and dynamically rebuilds the page title, header branding, and logo by fetching the company image in real time via Clearbit, logo.dev, and Google Favicons.

Malspam Campaign Uses DoubleClick Redirects

No organization-specific content is hardcoded anywhere. Swapping the email address in the URL instantly rebrands the entire lure, making the campaign cheap to operate while remaining visually convincing to each target, huntress said.

The page also calls ipapi[.]co to display the victim’s city and local time, further reinforcing a false sense of legitimacy. If no email fragment is present in the URL, the page silently redirects to Bing, a basic but effective measure to frustrate automated analysis.

Clicking “PDF herunterladen” (“Download PDF”) delivers a ZIP archive containing a heavily obfuscated JScript file. From there, the attack unfolds across five stages: HTML lure → JScript dropper → PowerShell stager → .NET loader → process-hollowed payload.

Upon execution, the JScript file relocates itself to C:\Users\Public\ on first execution, repairs a mangled base64 blob, and drops an encoded PowerShell script.

That script performs a connectivity check against Google before proceeding if offline, or if sandbox tooling is detected (Wireshark, OllyDbg, any.run, ImmunityDebugger), the script executes Restart-Computer -Force, deliberately rebooting the machine to disrupt triage.

The retrieved .NET loader fetched as 03.txt from an attacker-controlled host represents the campaign’s most technically aggressive component, huntress said.

Before executing, it sweeps for virtual machines, sandbox artifacts, cloud host indicators (Azure Guest Agent, RDP clip), and attached debuggers. Detection triggers machine reboots or silent exits, leaving behind only small marker files like vm.txt or Debugger.txt.

Once the environment clears, the loader:

• Patches AMSI at the native API level, targeting NtManageHotPatch on Windows 11 24H2 builds and overwriting the prologue to return STATUS_NOT_SUPPORTED
• Patches EtwEventWrite in ntdll.dll with xor rax, rax; ret, effectively silencing all ETW telemetry
• Disables Microsoft Defender real-time protection and adds the full system drive as an exclusion path
• Establishes persistence via Run/RunOnce registry keys and repeating scheduled tasks with randomized 8–11 minute intervals, using NVIDIA-themed folder and key names to blend in

Rather than dropping unsigned binaries, the loader injects the final payload into InstallUtil.exe or MSBuild.exe, both legitimate, Microsoft-signed processes, via standard RunPE process hollowing (CreateProcessA → ZwUnmapViewOfSection → VirtualAllocEx → WriteProcessMemory → ResumeThread).

All Win32 API names are base64-encoded with randomized @ characters inserted to defeat static detection.

The loader phones home over raw TCP to two DDNS-based C2 servers xtadts.ddns[.]net and afxwd.ddns[.]net on port 7211, using AES-encrypted, protobuf-serialized messages with PBKDF2-derived keys and RSA for initial key exchange.

The Huntress researchers stated that the DDNS infrastructure keeps rotation costs near zero; blocking an IP provides no lasting protection.

On first beacon, the loader fingerprints the host via WMI, collecting CPU, disk, and motherboard serials, and specifically enumerates NVIDIA (GTX/RTX) and AMD (Radeon) GPUs through both WMI and direct registry reads.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Mitigation

• Configure GPO to force .js, .vbs, and .hta files to open in Notepad by default, neutralizing script execution without additional user action
• Deploy email gateway sandboxing capable of inspecting attachments and links before delivery, not at the time of click
• Implement SPF, DKIM, and DMARC records to reduce spoofing exposure
• Alert on wscript.exe spawning encoded PowerShell from C:\Users\Public\
• Monitor for .js or .vbs files executing as child processes of explorer.exe

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.