LausivLoader analysis, or how to pass data between malware stages

As cited

Copy frozen at 2026-09-17 17:16 UTC (site build).

threat intel

LausivLoader analysis, or how to pass data between malware stages

LausivLoader is a multi-stage malware chain initiated via spearphishing emails with malicious JavaScript attachments. The JavaScript creates obfuscated PowerShell commands using environment variables to pass file paths between execution stages, then decrypts and loads .NET assemblies that progressively decode additional payloads, ultimately attempting to download a PNG file containing a final executable hidden in metadata.

Why it matters: Organizations should train users to reject unexpected quotation requests and review email gateway logs for similar malspam patterns; security teams analyzing this malware family need to understand that inter-process environment variable handoff allows incomplete command-line analysis, and endpoint detection systems must monitor scheduled task creation with 'MicrosoftEdgeUpdate' names, AMSI patching attempts, and PNG downloads from suspicious domains.

Source published

2026-09-17 15:06 UTC

First seen by Cybersecurity Tracker

2026-09-17 16:14 UTC