ASEC reports SnakeKeylogger phishing disguised as quote requests

What happened

According to the AhnLab Security Intelligence Center (ASEC), phishing emails disguised as requests for quotes are being circulated. ASEC says the email body poses as a message from a representative of the Materials Management Division in a Purchasing Department, asking the recipient to review a quote and to download an attached compressed file for verification ASEC. The article page is dated Nov 12 2026, while the headline list for this story gives 2026-11-11.

ASEC describes the following infection chain ASEC:

• The compressed file contains a JavaScript file that decrypts and runs an obfuscated, embedded PowerShell script.
• That script decrypts an encrypted payload with AES-256-CBC and runs it in memory. The payload is a second PowerShell script.
• The second script decrypts its own internal payload with an XOR operation and runs it in memory. It passes the path of aspnet_compiler.exe and the final payload as arguments.
• The loader starts aspnet_compiler.exe and uses process hollowing to inject the final payload into it.

ASEC says the final payload is SnakeKeylogger, an infostealer. It reportedly collects data stored in web browsers, system information and keylogging data, and sends it out through SMTP or Telegram ASEC.

What is not confirmed: the sources do not say how many recipients or organisations received the emails, who sent them, which regions or sectors were targeted, or whether any victim data was actually stolen. Only one outlet (ASEC) reports this, so there is no independent verification. The article does not tie the campaign to a named actor.

Am I affected?

ASEC does not publish a list of affected products, because the campaign relies on a malicious attachment rather than a software flaw. No CVE is cited. You may be exposed if a user opened the compressed attachment from a quote-request email and ran the JavaScript file inside. The operating system is not stated explicitly, but the chain uses PowerShell and aspnet_compiler.exe.

Indicators ASEC lists for SnakeKeylogger ASEC:

• MD5: e89c8668c8b5041768a59c1532edf2ad
• Mail server: hosting2.ro.hostsailor[.]Com
• Sender ID: logs@aewn[.]Buzz
• Recipient address: log@aewn[.]Buzz
• XOR key: THeSaTaN56@@^

ASEC says further IOCs and detailed analysis are available to subscribers of AhnLab TIP. Their contents are not confirmed here.

What to do now

1. Do not open compressed attachments from unexpected quote-request emails, and treat any .js, .exe or .vbs file inside an attachment as suspicious, as ASEC’s response guide advises ASEC.
2. Verify that the sender’s address uses an official domain before acting on the message ASEC.
3. Check the URL of any link in an email before clicking, and never enter credentials on a page whose URL does not match the official site ASEC.
4. Precaution, not from ASEC: search mail and endpoint logs for the MD5 and the sender or recipient addresses above. If a match turns up, investigate the affected host. ASEC says the malware targets browser data, so consider the credentials stored on that host exposed until the investigation says otherwise.

Sources

• ASEC: Beware of phishing emails disguised as quote requests (SnakeKeylogger)