Loading story…
A phishing campaign used purchase-order themed emails and a malicious Excel attachment to infect Windows systems with SmokeLoader, abusing the long-patched Microsoft Office vulnerabilities CVE-2017-0199 and CVE-2017-11882. Researchers said the spreadsheet hid its next stage in an encrypted OLE stream protected with Excel's default password, "VelvetSweatshop," then retrieved a disguised RTF file named receipt.doc that exploited the Microsoft Equation Editor flaw to continue execution.
After exploitation, the malware downloaded and launched SmokeLoader as vbc.exe, then repeatedly contacted a remote URL to fetch a GZip-compressed payload disguised as a JPG image. That payload decompressed into an obfuscated .NET DLL believed to be zgRAT, showing how attackers are still chaining older Office exploits and commodity loaders to deliver remote-access malware years after fixes for the vulnerabilities were released.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A phishing email themed around a purchase order used the attachment "Purchase Order FG-20220629.xlsx" to begin the infection chain. The filename anchors the lure to 2022-06-29, and the message targeted a webmail address at a large telecommunications company in Taiwan.
A CVE record exists for CVE-2017-0199, one of the Microsoft Office vulnerabilities later used in the analyzed infection chain.
The Fortinet report states that SmokeLoader, also known as Dofoil, has existed in some form since 2011.
Fortinet published analysis of a recent Windows infection chain in which an Excel lure exploited CVE-2017-0199 to fetch an RTF file exploiting CVE-2017-11882, which then downloaded SmokeLoader. The report assessed the final payload as a likely zgRAT sample and highlighted continued abuse of long-patched vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Threat actors are increasingly leveraging weaponized document formats and add-ins to compromise Windows users, with recent campaigns targeting organizations in multiple countries. One operation uncovered by researchers used phishing emails with RAR archives containing obfuscated JavaScript payloads, which exploited the CVE-2017-11882 vulnerability in Microsoft Office's Equation Editor. The infection chain included the use of malicious SVG files, ZIP archives with LNK shortcuts, and a sophisticated four-stage execution pipeline involving steganographically embedded .NET assemblies and the abuse of legitimate open-source libraries, all designed to evade detection and deliver commodity loaders for Remote Access Trojans and information stealers. Separately, attackers have been abusing Microsoft Excel's XLL add-in format to deliver malware, with a notable increase in such activity since 2021. Recent incidents include the submission of malicious XLL files to VirusTotal from Ukraine and Russia, which contained a backdoor named EchoGather capable of system reconnaissance, command execution, and file transfer. These XLL-based attacks often use open-source frameworks like Excel-DNA to facilitate payload delivery and in-memory execution, further complicating detection and mitigation efforts for targeted organizations.
Jun 29, 2026