The hybrid threat group GreyVibe is combining generative AI social engineering lures with custom-built PowerShell RATs and Android spyware. This post provides a deep technical analysis of their campaigns and defensive hunt guidance.
Redirection to fake CAPTCHA / verification pages mimicking Zoom or LAPAS
Victim is prompted to press Win+R, paste a malicious command with Ctrl+V, and hit Enter
Obfuscated PowerShell loader fires, leveraging LOOKVALPS or DAYLIGHT
PhantomRelay RAT executes, establishing an interactive shell with the C2
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.