Leaking Windows Creds Externally via MS Office – Tradecraft Security Weekly #21

Both campaigns involved the distribution of malicious emails purporting to be invoices, purchase orders, or quotation requests with attachments, which when opened triggers a PowerShell script fetching the trojanized image and executing a .NET-based loader to launch the payloads.

Attackers exploit PayPal’s email notifications to trick users into linking their accounts to attacker emails.

Most phishing clicks have been aimed at cloud apps, the most targeted of which were those made by Microsoft as threat actors sought to compromise Microsoft 365 and Microsoft Live credentials, according to a report from Netskope.