LAPSUS$ Phishing Campaign Targets Korean & Global Financial Sector
AhnLab ASEC has published a threat analysis of a multi-stage phishing campaign attributed to LAPSUS$, active since June 2026. The campaign targets the Korean and global financial sector, delivering a chain of HTML, JavaScript, EXE, and VBE attachments that culminate in an infostealer payload.
The initial HTML attachment executes a JavaScript dropper that downloads the EXE payload, which in turn spawns the VBE script to complete the infostealer deployment. ASEC notes the campaign is a standard LAPSUS$ delivery pattern, with the infostealer capturing browser credentials, cookies, and form data from targeted financial web portals.
Multi-Stage Phishing Chain: HTML, JS, EXE, VBE
The campaign delivers four attachments in sequence. The initial HTML file executes a JavaScript dropper that fetches the EXE payload, which then spawns a VBE script to complete the infostealer deployment. ASEC describes the chain as a standard LAPSUS$ delivery pattern, with the infostealer capturing browser credentials, cookies, and form data from targeted financial web portals.
LAPSUS$ Operational Model
LAPSUS$ does not use an affiliate model to operate its Ransomware-as-a-Service platform. Instead, its members complete every stage of the breach using social engineering, moving from initial access through credential harvesting and data exfiltration without the typical affiliate dashboard and payment split seen in most RaaS groups.
Key points
- AhnLab ASEC published a June 2026 threat analysis of a LAPSUS$ multi-stage phishing campaign.
- The campaign targets the Korean and global financial sector.
- The attack chain uses HTML, JS, EXE, and VBE attachments.
- The final payload is an infostealer.