Trend Micro

IRS-spoofing, taxes-themed, campaign found in environments protected by Cisco IronPort and Trend Micro delivers ConnectWise RAT via an embedded URL.

Adobe-spoofing emails found in environments protected by Microsoft ATP and Trend Micro deliver an LNK Downloader via an embedded URL. The LNK Downloader downloads and runs a series of PowerShell Scripts which download and run Needle RAT.

Voicemail-themed emails found in environments protected by Microsoft ATP and TrendMicro deliver an embedded link to a Malicious Batch Script. When run, the script runs a PowerShell Script that downloads and runs Remotely.

DHL-spoofing campaign found in environments protected by Trend Micro and Microsoft ATP delivers an attached VBS which drops and runs a Malicious Batch Script which runs XWorm RAT in memory.

ChatGPT-spoofing campaign found in environments protected by Trend Micro and Microsoft ATP delivers credential phishing via an embedded URL.

DBS-spoofing emails found in environments protected by Microsoft ATP and Trend Micro deliver an attached archive containing a VBS. The VBS downloads and runs a DotNETLoader and XWorm RAT.

Best Buy-spoofing campaign found in environments protected by TrendMicro and Amazon SES delivers an Windows Script File via an embedded link. The WSF, once run, downloads all necessary files which in turn, executes a Visual Basic Script, that runs a malicious Windows Batch Script that downloads and runs the AutoHotKey program needed to run a malicious AutoHotKey script. Once the AutoHotKey script is ran, it will download and run the Node JavaScript runtime environment which than runs all the necessary files to build and run Async RAT in memory

Notification-themed found in environments protected by TrendMicro and Amazon SES deliver Credential Phishing via a QR code embedded into an attached PDF.

eFax-spoofing emails found in environments protected by TrendMicro deliver ConnectWise RAT via an attached PDF.