ficus.in: picture files hiding the Remcos remote access trojan, and what to do if a script fetched them

What ficus.in is, and what we know about it

ficus.in is not a program on your PC. It is a web address, registered in India since 2010, that the abuse.ch project URLhaus lists ten times between 15 September and 1 October 2026 for picture files in a folder called img. Nine are tagged RemcosRAT, a remote access trojan for Windows, and all ten are tagged stego. We found no public write-up of this address, so this page rests on URLhaus, our own plain request and what Microsoft, MITRE and Seqrite publish.

An old domain with a normal web address that suddenly serves malware pictures from an image folder usually means one of two things: the site was broken into and a stranger uses its folder as free storage, or the domain changed hands.

We cannot tell which from the outside. Either way, the files were there, and either way the advice for a visitor and for a PC owner is the same.

1. 1

   What URLhaus lists

   Ten file addresses under hxxps://ficus[.]in/img/, each named img_ followed by six digits and the ending .png. The first was added on 15 September 2026, then one on 23 September, one on 24 September, five on 30 September and two on 1 October. All carry the threat label malware_download and the reporter abuse_ch. All ten were marked offline in our copy of the data on 8 October 2026.

2. 2

   What the tags mean

   stego is short for steganography: data hidden inside another file, here a picture. RemcosRAT names Remcos, a remote control tool sold by a company called Breaking Security that criminals use as a trojan. rat means remote access trojan. Nine files carry all three tags; img_011624.png, added on 30 September, is tagged only stego.

3. 3

   What we could not confirm

   We did not download any of the pictures, so we cannot tell you what is inside them, which Remcos build they carry or where it reports to. URLhaus shows tags, not a full analysis. We also do not know which program or email makes a victim's PC ask for these files. That first step is not visible from the server.

4. 4

   What this means for you

   If you only visited the ficus.in website, or saw its name in a log or a warning, you are not infected by that alone. The risk is for a Windows PC where a script was already running and went to fetch one of these pictures. A person browsing the site has no reason to request a file named img_220032.png directly.

Kind of threat

A web folder that served PNG files tagged stego; nine of ten tagged RemcosRAT, a remote access trojan for Windows

Where the files were

hxxps://ficus[.]in/img/img_NNNNNN.png, on the normal secure web port

Domain registered

18 April 2010, registrar Endurance International Group India Private Limited, status client transfer prohibited (RDAP, read 8 October 2026)

URLhaus entries

10 file addresses, added 15 September to 1 October 2026; all 10 offline when we read the data on 8 October 2026

Delivery trick

Steganography: code hidden in picture files so the download looks like an image. The entry step on the victim's PC is not known

Platform

Windows. MITRE lists Remcos for Windows only. Nothing we read says these pictures affect Mac, iPhone or Android

What we checked on 8 October 2026, and what we could not

We sent one plain request to ficus.in from our server on 8 October 2026: no browser, no clicks, no file downloads. The server answered with a redirect (HTTP 301) to https://www.ficus.in/ and named its web server software as nginx/1.29.8. That is all a plain request shows, and it clears nothing.

What happened to ficus.in, from registration to our check

The domain is sixteen years old, and the reports all fall within about two weeks. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 18 April 2010

   The domain is registered

   RDAP shows ficus.in registered on 18 April 2010 through Endurance International Group India Private Limited, with the status client transfer prohibited. A long history like this is typical of a real business site, not of a throwaway malware domain.

2. 15 September 2026

   The first picture is reported

   At about 15:27 UTC abuse.ch adds img_214254.png, tagged RemcosRAT, rat and stego.

3. 23 and 24 September 2026

   Two more files

   img_012405.png is added on 23 September at about 08:52 UTC and img_212442.png on 24 September at about 12:56 UTC, both with the same three tags.

4. 30 September 2026

   Five files in one day

   img_220032.png at about 06:00 UTC, then img_221258.png, img_215413.png and img_220602.png between 12:38 and 12:42 UTC, all tagged RemcosRAT, rat and stego. img_011624.png follows at about 14:50 UTC, tagged only stego.

   

5. 1 October 2026

   The last two reports

   img_210244.png and img_205551.png are added at about 16:12 UTC, both tagged RemcosRAT, rat and stego. This is the newest report we hold.

6. 8 October 2026

   All offline, and our check

   All ten addresses are marked offline in the URLhaus data. Our plain request to the domain returns a redirect to the www address, served by nginx.

What the pattern suggests, and what it does not: new file names kept appearing in the same folder for more than two weeks, which looks like someone with ongoing write access to the folder rather than a single leftover file. That is our reading of the dates, not something any report says.

How a picture file can carry Remcos

A picture that hides code cannot hurt you by being opened or looked at. It works only when a script that is already running reads the hidden part and starts it. We did not see the files on ficus.in; this is how Seqrite describes a campaign whose main payload was Remcos.

1. 1

   A phishing attachment opens

   Seqrite (17 March 2025) describes an Excel attachment that poses as a genuine file and abuses an old Office flaw, CVE-2017-0199, to request an .hta file from the internet. MITRE also lists spearphishing emails with Excel attachments as a way Remcos has spread.

2. 2

   Scripts fetch the next piece

   In Seqrite's chain the .hta file holds VBScript that writes a batch file. The batch file downloads an obfuscated VBS script, and that script hides a base64 encoded PowerShell command. The PowerShell command is the part that downloads a picture.

3. 3

   The picture holds a program

   Seqrite found picture files that hide base64 text between the markers <<BASE64 START>> and <<BASE64 END>>. The script searches the picture for those markers and decodes what lies between them into a loader. The picture still looks like an image to a filter that checks only file types.

4. 4

   The loader hides Remcos in a trusted program

   Seqrite describes process hollowing: the loader starts caspol.exe or msbuild.exe from C:\Windows\SysWOW64, empties it and writes the malware into it. MITRE lists process injection for Remcos. In Task Manager the process then has a genuine Windows name.

5. 5

   Remcos connects to its controller

   From then on a person elsewhere can use the PC. MITRE says Remcos encrypts its traffic with TLS and has used dynamic DNS addresses, so the connection does not stand out by its content.

Whether the pictures on ficus.in used the same markers, the same scripts or a different method is not known to us. The tags say only that something was hidden in them and that the hidden part was identified as Remcos.

What Remcos is

Remcos is sold openly as remote control and surveillance software by a company called Breaking Security, and criminals use it as a remote access trojan. The sources agree on what it can do; they differ in the details of each campaign.

What Remcos can take from a Windows PC

A remote access trojan gives a stranger a seat at your computer, so the list below is what such a person can do, not what every build does on its own. Each item is named by MITRE or Microsoft.

What this can cost you

Visiting the ficus.in website or seeing its name costs nothing by itself. The risks below apply to a Windows PC where a script fetched one of these pictures and Remcos then ran.

• High

  Passwords and accounts

  A keylogger records what you type into every site, including new passwords you set on the same PC. Change passwords from another device, or the person watching sees the new ones too.

• High

  Someone using your PC live

  Remcos is built for remote control. The controller can come back at any time, watch the screen and run commands while you are signed in.

• High

  Money and crypto

  Clipboard access means a copied wallet address can be swapped, and a bank session opened on the PC can be watched. Crypto sent to the wrong address cannot be recalled.

• Medium

  Camera, microphone and private files

  MITRE and Microsoft list webcam pictures, audio recording and file download. Documents and photos on the PC are exposed.

• Medium

  More malware on the same PC

  Seqrite found the same picture campaign delivering several families, and in some cases Remcos itself installed AgentTesla, a password stealer.

• Low

  Nothing, if you only saw the name or visited the site

  A name in a block list, a log or a warning is not an infection, and the reported files are offline now.

What you may notice, and what you may not

Remcos is designed to stay hidden. The signs below come from the sources and from what they imply; none is certain, and many victims notice nothing.

How a person ends up asking for these pictures

Nobody types a file address like hxxps://ficus[.]in/img/img_205551.png on purpose. The request comes from a program, so the real question is how that program got onto the PC. We cannot say for this site; the routes below are those the sources describe for Remcos and the picture trick.

1. 1

   An email attachment

   Seqrite's campaign began with an Excel file posing as a genuine document, and MITRE lists spearphishing with Excel attachments for Remcos. Opening the file is what starts the chain.

2. 2

   A file from an unknown source

   Microsoft's advice for Remcos is to avoid opening files that do not come from a legitimate source. Invoices, orders and shipping notices that you did not expect are the usual disguise.

3. 3

   Not by browsing the site

   Visiting the ficus.in home page in a browser is a different request from a script fetching a file from its img folder. We found nothing that says the site's own pages pushed Remcos to visitors.

If you own or run ficus.in

An old domain listed for malware files in an image folder is a typical sign of a hacked site. If the site is yours, treat the server as broken into until you know how the files got there. This is our advice for a site owner, not a procedure from a vendor.

Look in the img folder and in its history for files named img_ followed by six digits and .png that you did not upload, and keep a copy for your host before deleting them.

Then change every password for hosting, FTP, the database and the site's admin accounts, remove admin users you do not know, update the site software and its plugins, and ask your hosting provider for access logs from 15 September 2026 onward. Once the folder is clean, request a new check from URLhaus so the listing reflects it.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact ficus.in's img folder, or did you open an unexpected Office attachment, script or installer around mid September to early October 2026? If you saw the name in a firewall or DNS log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A remote access trojan needs the connection to be used.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, and only if it asked for a file in the img folder.

3. 3

   Look at the Run key and Startup apps

   MITRE names the key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Open Registry Editor and look there for names or paths you do not recognise, especially files in your user folder or in Temp. A simpler view is Settings > Apps > Startup. Write down what you find; do not delete yet.

4. 4

   Look for genuine programs that should not be running

   Open Task Manager and look for caspol.exe or msbuild.exe, or any process using a lot of network for no reason. Seqrite names these two as hiding places. They are real Windows programs, so their presence is not proof and their absence does not clear the PC.

5. 5

   Search the registry for Remcos

   In Registry Editor, open HKEY_CURRENT_USER\SOFTWARE and look for a key whose name starts with Remcos. Microsoft's sample created one. Many builds rename it, so not finding one proves nothing.

6. 6

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for a detection naming Remcos, such as Backdoor:Win32/Remcos, or for anything blocked or quarantined at the time of the first contact. Microsoft says offline scan results also appear here.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.

8. 8

   A scan helps, but it does not clear the PC

   Microsoft notes that even after Defender removes a threat, remnant files and system changes can remain, and says to run a full scan with updated definitions. Treat a clean result as one data point. We did not infect a PC, so the order of this plan is our judgement from Microsoft's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags and every source we read describe a Windows threat. We found nothing that says the pictures on ficus.in affect anything else.