A recent campaign against cryptocurrency companies has seen the Malware-as-a-Service (MaaS) Remote Access Trojan (RAT) Parallax utilizing process hollowing to make itself more difficult to detect. According to threat researchers at Uptycs, the initial payload was delivered via a phishing email and established persistence by adding itself to the Windows startup folder. The first payload then injected the second stage of the attack into a legitimate Windows component called “pipanel.exe”. From here, the malware begins to steal information from the victim machine. The attackers have also been noted to use notepad.exe to communicate with their victims, typically instructing them to connect to an attacker-controlled Telegram channel.