Loading story…
An unattributed malware campaign used a weaponized Word document named Card & Booking Details.docx to launch an obfuscated PowerShell infection chain. The document retrieved a remote RTF object and macro-enabled Excel content, then established persistence, bypassed AMSI, disabled Microsoft Defender and the Windows firewall, created a local administrator account capable of Remote Desktop access, and deleted Word documents from Desktop and Downloads folders.
A custom obfuscated .NET loader used process hollowing against signed Microsoft .NET utilities to run XWORM or Agent Tesla in memory. The operators staged and updated payloads through MediaFire and a Blogspot feed; the analyzed Agent Tesla payload exfiltrated collected data to an attacker-controlled Discord webhook. Organizations should investigate malicious Office-document activity, suspicious wscript or PowerShell execution, security-control tampering, unexpected local administrator creation, and outbound connections to MediaFire, Blogspot, and Discord webhooks.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
An unattributed threat actor used a fake Word document, "Card & Booking Details.docx," to fetch a malicious RTF and macro-enabled Excel content that launched an obfuscated PowerShell infection chain. The chain established persistence, impaired defenses, enabled RDP access, and process-hollowed signed .NET utilities to run XWORM or Agent Tesla; the observed Agent Tesla sample exfiltrated data through a Discord webhook.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a phishing-led **Agent Tesla** infection chain that starts with a payment-receipt-themed email attachment and escalates through multiple scripted stages to full compromise. The campaign avoids older Office exploit techniques such as `CVE-2017-11882`, `CVE-2017-0199`, and `CVE-2018-0802`, instead relying on heavily obfuscated Batch and PowerShell loaders to launch payloads in memory, execute hidden scripts, and establish persistence while reducing visibility to traditional defenses. The final VB.NET payload uses anti-debugging, anti-sandbox, and anti-VM checks before performing **process hollowing** into legitimate Windows binaries such as `charmap.exe`. Once active, Agent Tesla steals browser credentials, cookies, autofill data, keystrokes, and screenshots, then exfiltrates the data over channels including SMTP, FTP, and Telegram bots, highlighting the threat posed by fileless execution and in-memory process injection in commodity malware campaigns.
Jun 29, 2026
Researchers traced a **SideWinder** spearphishing campaign to a malicious Word document named **"Briefing on Ongoing Projects.docx"** that fetched a remote RTF template from a spoofed domain and exploited Microsoft Equation Editor via `CVE-2017-11882`. The recovered RTF decrypted embedded JavaScript, launched an obfuscated script, and executed a .NET component that profiled installed antivirus products before attempting to download a further payload stage. Investigators found the originally malicious RTF had later been replaced with a nearly empty placeholder file, a tactic that obscured follow-on analysis while preserving infrastructure clues. Additional infrastructure and tradecraft links tied the activity to broader South Asian espionage patterns involving malicious RTF lures, Equation Editor exploitation, and multi-stage loaders. Fortinet separately documented a spearphishing attack against a telecommunications agency in South Asia using an RTF lure that exploited `CVE-2018-0798`, abused **Logitech** DLL search order hijacking with a signed executable and malicious `LBTServ.dll`, injected into `svchost.exe`, and contacted `instructor[.]giize[.]com` to retrieve a payload linked through OSINT to **PoisonIvy RAT**. Across the references, the campaigns show consistent use of document-based initial access, obfuscated intermediate stages, and reusable infrastructure and tooling associated with long-running regional espionage operations.
Aug 15, 2026
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026