Finance-Lure VBScript Spoofs CSV Type to Evade Static Scanners
A Formbook delivery campaign has introduced a VBScript downloader whose file magic is reported as CSV text, suppressing detection across major EDR and AV engines. The same C2 domain registered days before the campaign wave remains active, serving a PNG-disguised second-stage payload to targets across 35 countries and 13 industry verticals.
A Finance-Lure ZIP Rewrites Its Own File Type to Slip Past Static Scanners
Three new file variants have surfaced in an ongoing Formbook delivery campaign that CTX Team has been tracking since its prior coverage (earlier coverage), and the most significant change is not a new payload family or a fresh infrastructure node — it is a quiet manipulation of file-type metadata. The outer ZIP container drops a VBScript downloader whose file magic is reported as "CSV text" despite carrying a .vbs extension and an uncompressed size of nearly two megabytes, a type-confusion artefact that meaningfully degrades static detection and that was not present in the earlier snapshot. The C2 domain basefile.click, registered on 2026-06-09 via Spaceship, Inc. and still resolving to 45.136.5.4, remains active and continues to serve a second-stage resource disguised as a PNG image. The campaign's declared reach spans 35 countries and 13 industry verticals, but the finance-themed lure names — "Quotation.vbs" and "Swift-015062026.vbs" — point most directly at accounts-payable and treasury staff as the intended first point of contact.
The prior article established the core delivery pattern. What this snapshot adds is evidence of active tooling iteration: the operator has introduced a low-cost obfuscation layer between campaign waves, tested it against the same C2 infrastructure, and kept the sleep-evasion staging behaviour that was already documented. That combination — iterative evasion refinement on a stable infrastructure node — is the signal worth examining in depth.
The CSV Disguise: How a VBScript Becomes a Spreadsheet
The centrepiece of the updated tooling is a file that VirusTotal's type-detection pipeline classifies as "CSV text" (type extension: csv, magic: CSV text) while its meaningful name ends in .vbs and its size sits at 1,957 KB — nearly two megabytes for what would, if genuine, be a trivial comma-separated values file. CTX Team's analyst flags this as a deliberate type-confusion obfuscation artefact [T1027], explicitly noting that the mismatch is "not shared by its ZIP sibling," making it a standalone outlier within the file set.
The practical effect of this mismatch is straightforward: security tooling that routes files to different analysis pipelines based on declared magic type — rather than extension or content heuristics — will treat this payload as a benign data file rather than a script. Static engines that do not resolve the contradiction between the csv magic and the .vbs extension will either skip script-specific detection logic or apply lower-confidence heuristics. The detection ratio bears this out: 25 of 75 engines flag the VBS payload, leaving 29 engines returning clean verdicts and a further 13 reporting the type as unsupported. Notable absences from the flagging list include CrowdStrike, Elastic, Cylance, Malwarebytes, and AhnLab-V3 — a meaningful gap across both next-generation EDR platforms and traditional AV engines.
The outer container, a 13 KB ZIP archive (sha256: fe4feae078353bf7b2fc20dc3b9f3e6ca9a3176d31dc331d715277d1bbb855cf), fares only marginally better: 19 of 76 engines flag it, with CrowdStrike, Elastic, Cylance, and DeepInstinct all absent from the flagging list. The ZIP's uncompressed size of 2,004,866 bytes — approximately 154 times its compressed footprint — is consistent with deliberate padding inside the VBS payload, a technique that exploits size-based attachment filter thresholds and inflates the file to a size that some sandbox environments will refuse to process in full.
Neither file carries a code-signing certificate, and neither has an import hash, which eliminates two of the most reliable static clustering axes. Build-pipeline linkage between these files and any broader tooling ecosystem cannot be established at present. What can be said is that the ZIP's bundle metadata records a single child with a .vbs extension, a creation timestamp of 2026-06-16 09:10:04, and an uncompressed size that matches the inner VBS — confirming the one-to-one container relationship.
The type-confusion technique is not exotic in the abstract — file-type spoofing has appeared in various crimeware delivery chains — but its introduction into this specific campaign between the prior snapshot and the current one is a concrete signal that the operator reviewed detection coverage and made a targeted adjustment. The 25/75 detection ratio on the VBS, compared with the 19/76 on the ZIP, suggests the inner payload is slightly better-known to the engine population, which in turn suggests the type-confusion layer is doing some of the work of suppressing that recognition.
Sleep, Wait, Download: The Evasion Staging Behaviour
Once a recipient extracts and executes the VBS payload [T1059.005], the script does not immediately proceed to its download stage. VirusTotal's behavioural tags on the file — "idle" and "long-sleeps" — confirm that the script incorporates deliberate execution delay loops designed to outlast the time windows that automated sandbox environments allocate to dynamic analysis. This is a well-understood evasion pattern in commodity loader staging: a script that sleeps for longer than the sandbox's analysis window will appear to do nothing, receive a clean or inconclusive verdict, and only execute its malicious logic after the analysis session has terminated.
Both sandboxes that processed the VBS payload returned malicious verdicts. CAPE Sandbox classified it as malicious and named the family as Formbook. Yomi Hunter also returned a malicious verdict. The 2/2 consensus, combined with CAPE's explicit family attribution, establishes Formbook as the confirmed terminal payload with high confidence. The VBS itself is classified by threat label as trojan.dloader/abdownloader, with popular names including "dloader," "abdownloader," and "ador" — a naming cluster consistent with generic downloader-stage identifiers used across multiple commodity campaigns.
The Sigma rule coverage on this file is extensive: the Joe Security rule set contributes 2 critical-severity matches, while the Sigma Integrated Rule Set (GitHub) adds 4 high-severity and 8 medium-severity matches, for a total of 15 Sigma hits across severity bands. This breadth of Sigma coverage suggests the behavioural profile of the VBS — script execution patterns, process spawning, network connection attempts — maps onto a wide range of documented malicious-script signatures, even if the static detection rate remains moderate.
The IDS rule hits from sandbox network traffic add another layer of behavioural evidence. Two Proofpoint Emerging Threats Open rules fired during sandbox execution of the VBS: the high-severity ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1, categorised as "Exploit Kit Activity Detected," and the medium-severity ET DROP Spamhaus DROP Listed Traffic Inbound group 7, categorised as "Misc Attack." The first rule's name references a 2015 exploit-kit landing-page pattern using base64-encoded parameters — its firing here indicates the VBS's outbound HTTP traffic structurally resembles that pattern, likely because the download request uses base64-encoded query parameters in a format that predates modern C2 frameworks but remains in use in commodity loaders. The second rule confirms the VBS contacted infrastructure listed on the Spamhaus DROP blocklist during sandbox execution, which is consistent with the C2 domain's multi-vendor malicious categorisation.
The fuzzy hash profile of the VBS — ssdeep 192:MVrOxVPLWJELG06/Owt7xVaPqwIEQNmcVV/E/PJ1RWNi7iI6LpJ1qgI1q/m6/aIT:5W1hP, TLSH T14C958F9DBD7788DD65CD478C7B8C9162C91734C5D0BA0FEB81322584366AB8A31CDAF8 — provides a fuzzy-matching anchor for hunting related variants, though without imphash or signing data, the clustering radius is limited to content-similarity rather than build-pipeline identity.
The Infrastructure Node: One Domain, One Certificate, One IP
The entire campaign's network infrastructure, as currently observable, resolves to a single node: the domain basefile.click, registered on 2026-06-09 via Spaceship, Inc., resolving to the IP address 45.136.5.4, and delegating DNS authority to ns1.whitelabelservices.us and ns2.whitelabelservices.us. This is a deliberately minimal footprint — one registrar, one IP, one nameserver provider — that keeps operational surface area small and burn cycles short.
The TLS certificate issued for the domain was obtained from Let's Encrypt (issuer CN: YR2) on the same day as domain registration — 2026-06-09 09:28:24 — with a validity window of 89 days running to 2026-09-07 and a serial number of 612d39cad88012a99e1441f1c7b5fce9fd1. The certificate's subject is *.basefile.click, a wildcard SAN that covers both the apex domain and any subdomain or path-level resource. This wildcard configuration is operationally significant: it means the operator can serve arbitrary resources — including the second-stage payload at /optimized_MSIljune.png — under a single trusted certificate without re-issuing or acquiring additional certificates for each new payload path. The friction of adding new staging URLs is effectively zero once the wildcard cert is in place.
The files in this snapshot first appeared on VirusTotal on 2026-06-16, seven days after domain registration. That gap is consistent with a purpose-built staging host stood up in advance of a campaign wave: the operator registered the domain, obtained the wildcard certificate on the same day, and then launched the phishing wave approximately a week later once the infrastructure was confirmed operational. The domain's recorded lifespan between creation and last observed activity is 15 days — a short-burn window that suggests the operator expects the domain to be flagged and rotated rather than maintained long-term.
Four independent vendor categorisation systems have flagged basefile.click as malicious: alphaMountain.ai categorises it as "Malicious, Newly Registered"; Sophos as "spyware and malware"; Webroot as "Malware Sites"; and Forcepoint ThreatSeeker as "malicious web sites." Despite this multi-vendor consensus, the domain's VirusTotal detection ratio sits at only 14 of 91 engines, and the community vote count is zero — indicating that automated categorisation systems have caught up with the domain faster than the broader engine population.
The SPF record for basefile.click explicitly authorises 45.136.5.4 (v=spf1 +a +mx +ip4:45.136.5.4 ~all), and the MX record self-references the domain. This DNS configuration suggests the operator provisioned mail-sending capability from the same host, which is consistent with a delivery model where the phishing emails themselves originate from the C2 infrastructure rather than a separate mail platform. Whether that mail capability was actively used in this campaign wave cannot be confirmed, but the configuration is not incidental — SPF and MX records require deliberate setup.
The whitelabelservices.us nameserver delegation is worth noting as a potential pivot point. Nameserver infrastructure shared across multiple domains registered through the same operator can expose campaign-level patterns even when individual domains are rotated. No cross-NS cohort links to other domains have been identified, so the infrastructure picture remains single-node for now — but the nameserver pattern is a durable fingerprint that outlasts individual domain registrations.
Delivery and Staging: Finance Lures, Padded Containers, and a PNG That Is Not a PNG
The attack chain opens with a phishing email carrying the ZIP archive as an attachment [T1566.001]. The submission path recorded in the ZIP's meaningful name — /tmp/eml_attach_for_scan/7860bd0f38f38b3b9484c7b8e9043ce2.file — confirms the file was processed through an email-attachment scanning pipeline, consistent with delivery as a mail attachment rather than a web download or USB drop. The ZIP's single child carries the alternative names "Quotation.vbs" and "Swift-015062026.vbs" — finance-themed lure names that impersonate business documents a recipient in an accounts-payable, treasury, or procurement role would expect to receive. The "Swift" prefix references the SWIFT interbank messaging network, a naming choice that targets financial operations staff specifically.
The ZIP itself (threat label: trojan.ador/arch, vhash: 538e951aadcae51bcbd7646c15c09d66) is 13 KB compressed but expands to 2,004,866 bytes — a compression ratio that immediately signals padding. The inner VBS [T1027] presents the CSV type-confusion layer described above, and once executed [T1059.005], enters its sleep-evasion phase before proceeding.
When the sleep period expires, the downloader contacts basefile.click over HTTPS [T1071.001] — a connection that sandbox network traffic analysis captured and that triggered the two Proofpoint ET IDS rules noted earlier. The C2 communication uses base64-encoded parameters in a pattern the ET EXPLOIT_KIT rule associates with exploit-kit landing-page traffic, suggesting the downloader's request format is borrowed from or shares lineage with older EK-style staging code.
The second-stage resource is served at the path /optimized_MSIljune.png. The filename stem contains "MSI," which the analyst identifies as strongly suggestive of a Windows Installer or PE binary served with a PNG extension to bypass content-type inspection controls [T1105] — a technique that exploits the gap between a file's declared MIME type and its actual binary format. This inference is assessed at medium confidence: the URL is confirmed as a campaign IOC, and the naming pattern is consistent with the technique, but current evidence is too thin to confirm direct execution of the retrieved file. The wildcard TLS certificate means the resource is served over a trusted HTTPS connection, further reducing the likelihood of interception by content-inspection proxies that do not perform deep packet inspection on encrypted traffic.
The terminal payload, confirmed by CAPE Sandbox, is Formbook — a commodity infostealer and keylogger available on crimeware markets. Formbook's capabilities include credential harvesting from browsers and mail clients, keylogging, screenshot capture, and clipboard monitoring. Its commodity availability means the operator does not need to develop or maintain custom malware; the staging chain described above is the operator's primary value-add, and the type-confusion obfuscation layer is the newest iteration of that staging investment.
The Uncharacterised Third File and What It Leaves Unresolved
The three new files in this snapshot include one — sha256: d1c2e36da8e7346de14246b21f1ec394d8bbac44849e6214cf6828d5b621196b — that is entirely uncharacterised. CTX Team's analyst flags this file as having no recorded type, size, detection ratio, threat label, or submission metadata. Its relationship to the confirmed Formbook delivery chain is unknown, and it cannot be placed in the attack sequence without further analysis.
The presence of this file in the same campaign snapshot as the two characterised files raises questions that current evidence cannot answer. If it is a second ZIP variant with a different lure name, it would extend the delivery surface without changing the chain's structure. If it is a loader or persistence component introduced between the VBS download stage and Formbook installation, the chain's complexity would have grown beyond what current evidence supports. If it is an artefact of the collection process — a file associated with the campaign by proximity rather than function — it may be analytically irrelevant. All three readings are plausible; none can be confirmed.
This gap is a meaningful limitation on the current analysis. The two characterised files — the ZIP and the VBS — provide a coherent two-stage delivery picture with sandbox confirmation of the terminal family. The third file sits outside that picture entirely, and its eventual characterisation could either confirm the chain as described or require a significant revision.
Only the VBS payload (53d42bae) has both sandbox verdicts and a meaningful detection ratio, qualifying as the single strong indicator in the set. The ZIP (fe4feae0) has a detection ratio but no sandbox verdicts, placing it in the moderate-to-weak category. Neither file has an import hash or code-signing certificate, which eliminates build-pipeline clustering and supply-chain framing as analytical options. The domain basefile.click has multi-vendor categorisation and certificate anomalies but zero community votes. CTX Team's overall confidence assessment for this snapshot is low (score: 28), reflecting the thin evidence base relative to the campaign's apparent operational scope.
Operational Iteration on a Commodity Platform: What the Delta Signals
The shift from the prior snapshot to this one is best read as evidence of operational maintenance rather than a capability leap. The operator has not switched malware families, changed infrastructure providers, or adopted a new delivery vector. What they have done is introduce a type-confusion obfuscation layer — presenting a VBS payload as a CSV file — that costs almost nothing to implement and measurably degrades static detection coverage. The 25/75 detection ratio on the VBS, with major EDR platforms absent from the flagging list, suggests the technique is achieving its intended effect against at least a portion of the engine population.
This pattern of low-cost iterative evasion refinement is characteristic of financially motivated crimeware operators who treat their delivery chain as a product to be maintained between campaign waves. The actor behind this campaign carries no attribution to a named threat group, and the use of commodity Formbook malware is consistent with a financially motivated operator who purchases or rents the terminal payload rather than developing it. The finance-themed lure names ("Quotation," "Swift") and Formbook's credential-harvesting capabilities together suggest the operator's objective is business email account compromise or banking credential theft, targeting accounting and treasury staff across the campaign's unusually broad geographic and sectoral footprint.
That footprint — 35 countries spanning Europe, Asia-Pacific, the Americas, and Africa, and 13 industry verticals including financial services, manufacturing, technology, telecom, healthcare, and energy — is more consistent with opportunistic mass-phishing than precision targeting. The lure names are generic enough to be plausible across any organisation that processes supplier invoices or interbank transfers, which describes virtually every mid-sized enterprise in the declared target regions.
The infrastructure strategy reinforces the low-cost, high-rotation model. A freshly registered .click TLD domain, a same-day Let's Encrypt wildcard certificate, a single IP, and nameserver delegation to whitelabelservices.us together describe an operator who expects each infrastructure node to have a short operational life and has optimised for rapid replacement rather than durable concealment. The 15-day lifespan between domain creation and last recorded activity is consistent with that expectation. The wildcard certificate reduces the per-payload cost of adding new staging URLs, and the self-referencing MX record suggests the operator has provisioned the same host for mail delivery — a configuration that, if confirmed in use, would collapse the phishing and staging infrastructure into a single node and further reduce operational overhead.
What the CSV magic-type spoofing signals, in the broader context of commodity crimeware evasion, is that static file-type classification remains a meaningful detection surface that operators are actively probing. The technique is not novel in principle, but its appearance in a second snapshot of this campaign — absent from the prior wave and present in the current one — indicates the operator reviewed coverage gaps between waves and made a targeted adjustment. If the technique continues to suppress detection rates in subsequent waves, it is likely to persist; if engine coverage catches up, the operator will iterate again. The uncharacterised third file (d1c2e36d) is the most significant unresolved question: if it proves to be a new component in the staging chain rather than a variant or artefact, the operator's tooling investment will have grown in ways the current evidence cannot yet describe.
