---
title: "Discussion on \"From Malspam to a Fileless .NET Loader: Abusing Google DoubleClick and a Five-Stage Evasion Chain\" | Hashnode"
description: "Discussion on \"From Malspam to a Fileless .NET Loader: Abusing Google DoubleClick and a Five-Stage Evasion Chain\". A German-language \"purchase order\" email with an HTML attachment is the opening move of a five-stage attack chain in which the malicious link routes through ad.doubleclick[.]net — a high-reputation Go"
url: "https://hashnode.com/posts/from-malspam-to-a-fileless-net-loader-abusing-google-doubleclick-and-a-five-stage-evasion-chain/6a39ed204a985dfa4235edf4"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [From Malspam to a Fileless .NET Loader: Abusing Google DoubleClick and a Five-Stage Evasion Chain](https://blog.fiscybersec.com/from-malspam-to-a-fileless-net-loader-abusing-google-doubleclick-and-a-five-stage-evasion-chain?utm_source=hashnode&utm_medium=feed)

A German-language "purchase order" email with an HTML attachment is the opening move of a five-stage attack chain in which the malicious link routes through ad.doubleclick\[.\]net — a high-reputation Go

Jun 23 · 13 min read · blog.fiscybersec.com  
Read the article

-   [#malspam](https://hashnode.com/tag/malspam)
-   [#dotnet](https://hashnode.com/tag/dotnet)
-   [#loader](https://hashnode.com/tag/loader)
-   [#fileless](https://hashnode.com/tag/fileless)
-   [#doubleclick](https://hashnode.com/tag/doubleclick)
-   [#process-hollowing](https://hashnode.com/tag/process-hollowing)
-   [#amsi-bypass](https://hashnode.com/tag/amsi-bypass)
-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)
-   [#mitre-attack](https://hashnode.com/tag/mitre-attack)

## Written by

[Vũ Nhật Lâm](https://hashnode.com/@kami61)

@kami61

  
[View profile](https://hashnode.com/@kami61)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.