Loading story…
A malspam campaign delivered a file named MT-209111.DOC that posed as a Word document but was actually an RTF containing four embedded Excel OLE objects. Opening the lure triggered repeated Excel macro prompts, and the embedded spreadsheet used layered obfuscation to decrypt and launch a PowerShell stage, which then decrypted and compiled obfuscated C# code in memory. The chain also attempted an AMSI bypass by patching memory before retrieving the next payload.
The final stage downloaded an executable from 104.244.79.123/As/MT-209111.jpg into the victim's AppData directory as c2ef3.exe and executed it. Although the payload was unavailable during analysis, corroborating data from URLhaus and Any.Run linked the downloaded file to the AZORult infostealer. The infection flow combined Word, Excel, OLE object auto-update behavior, PowerShell, and custom multi-layer encryption to improve the chances of successful macro execution and payload delivery.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
On February 3, 2020, SANS ISC published an analysis of a malspam-delivered attachment named MT-209111.DOC that used embedded Excel OLE objects, VBA, PowerShell, and obfuscated C# to download and execute an AZORult payload. The write-up documented the downloader chain, AMSI bypass attempt, download URL, and associated file hashes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AZORult, a long-running credential-stealing malware family tied to the **Genesis Store** cybercrime marketplace, has continued to appear in new delivery campaigns despite earlier reports that browser security changes had crippled its core theft capabilities. Earlier research linked more than **300,000 infections** sold through Genesis to AZORult or its suppliers, showing how the malware fit into a broader malware-as-a-service and stolen-access supply chain. Although a Google Chrome update was reported to have disrupted older AZORult builds and pushed some criminal operators toward other stealers, subsequent activity indicates the malware remained in circulation through updated or repackaged campaigns. Recent and historical reporting shows AZORult being distributed through **spam emails**, **ZIP or ISO archives**, malicious **LNK** and **HTA** files, and heavily obfuscated script chains using PowerShell, batch files, JavaScript, and scheduled tasks. The malware has been used against targets including **Korean users** and **German automotive businesses**, where it stole browser credentials, cookies, autofill data, email and messaging app data, cryptocurrency wallet files, screenshots, and system information, while also supporting follow-on payload delivery. Newer campaigns emphasized **in-memory execution**, anti-analysis checks, and minimal disk artifacts to evade detection, underscoring AZORult's persistence as a commodity infostealer within a more outsourced and opportunistic cybercrime ecosystem.
Aug 15, 2026
Netskope Threat Labs reported a campaign using malicious Web Page Archive files (`.mht`/`.mhtml`), often delivered inside RAR archives, to infect Microsoft Word users with a DLL backdoor. The attack abuses the Windows `Zone.Identifier` alternate data stream by setting `ZoneId=2`, causing the archive to appear trusted enough for Word to open with fewer warnings. Once opened, the lure document uses password-protected and obfuscated VBA macros to drop, repair, rename, and execute the payload while displaying a decoy document to the victim. The final payload is a packed 64-bit DLL named `background.dll` that establishes persistence through a scheduled task called **Winrar Update**, injects into a long-running `rundll32.exe` process, and collects host and file-system information before encrypting and exfiltrating it to command-and-control infrastructure hosted on Glitch. Microsoft documentation identifies `Zone.Identifier` as the stream name used to store zone information in Windows, supporting the mechanism abused in the campaign. Netskope said the tradecraft overlaps with earlier activity linked to **APT32/Ocean Lotus**, including prior use of Web Archive delivery and a similar backdoor seen in 2021.
Aug 15, 2026
An unattributed malware campaign used a weaponized Word document named `Card & Booking Details.docx` to launch an obfuscated PowerShell infection chain. The document retrieved a remote RTF object and macro-enabled Excel content, then established persistence, bypassed AMSI, disabled Microsoft Defender and the Windows firewall, created a local administrator account capable of Remote Desktop access, and deleted Word documents from Desktop and Downloads folders. A custom obfuscated .NET loader used process hollowing against signed Microsoft .NET utilities to run **XWORM** or **Agent Tesla** in memory. The operators staged and updated payloads through MediaFire and a Blogspot feed; the analyzed Agent Tesla payload exfiltrated collected data to an attacker-controlled Discord webhook. Organizations should investigate malicious Office-document activity, suspicious `wscript` or PowerShell execution, security-control tampering, unexpected local administrator creation, and outbound connections to MediaFire, Blogspot, and Discord webhooks.
Sep 9, 2026