Cybercriminals are using virtual hard drives to drop RATs in phishing attacks


- Virtual hard drives are being abused in phishing campaigns, experts warn
- The virtual drives are used to drop RAT malware into unsuspecting inboxes
- The attack vector is particularly difficult of antivirus to detect
Mountable virtual hard drive files, typically in .vhd and .vhdx formats, allow users to create virtual volumes that function like physical drives in a Windows environment.
While these files have legitimate uses in software development and virtual machines, cybercriminals have increasingly exploited them to deliver malware, experts have warned.
Recent research by Cofense Intelligence has revealed such tools are now being used to bypass detection mechanisms like Secure Email Gateways (SEGs) and antivirus solutions to drop Remote Access Trojans (RATs).
The rising use of virtual hard drive files
This exploitation is particularly difficult to detect, even with sophisticated scanning tools employed by SEGs and antivirus solutions, as the malware remains hidden within the mounted files.
The latest campaign has shifted focus toward resume-themed phishing attacks targeting Spanish-speaking individuals. The emails contained .vhdx files that, when opened, executed Visual Basic Script to load the Remcos RAT into memory.
This campaign notably included autorun.inf files designed to take advantage of older versions of Windows that still support AutoRun capabilities, further demonstrating the attackers’ intention to exploit a wide range of potential victims with varying system setups.
AutoRun, a feature in older versions of Windows, allows a file to execute automatically when a volume is mounted. Attackers have often exploited this feature to run malicious payloads without user intervention in systems where AutoRun is enabled.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Although Windows Vista and later versions mitigate these risks by disabling automatic execution, users with outdated systems remain vulnerable to silent malware execution. Even without AutoRun, attackers can use AutoPlay to prompt victims into manually running the malicious payload, leveraging the human factor to bypass security controls.
Attackers were also able to bypass various SEGs by embedding malicious content within virtual hard drive files inside archive attachments, bypassing SEGs from major security vendors, such Cisco and Proofpoint.
Threat actors further complicate detection by manipulating file hashes within virtual hard drive files. By adding unnecessary filler data or modifying storage space allocation, they can create files that appear different in scans but still deliver the same malicious payload.
More from TechRadar Pro
Virtual hard drives are being abused in phishing campaigns, experts warn The virtual drives are used to drop RAT malware into unsuspecting inboxes The attack vector is particularly difficult of antivirus to detect Mountable virtual hard drive files, typically in .vhd and .vhdx formats, allow users to create virtual volumes…
Recent Posts
- This surprisingly simple way to hide hardware security keys in mainstream flash memory could pave the way for ultra-secure storage very soon
- Quordle hints and answers for Sunday, July 6 (game #1259)
- NYT Connections hints and answers for Sunday, July 6 (game #756)
- NYT Strands hints and answers for Sunday, July 6 (game #490)
- The 55 Best Deals From REI’s July 4 Outdoor Gear Sale (2025)
Archives
- July 2025
- June 2025
- May 2025
- April 2025
- March 2025
- February 2025
- January 2025
- December 2024
- November 2024
- October 2024
- September 2024
- August 2024
- July 2024
- June 2024
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022