Loading story…
Palo Alto Networks' Unit 42 reported a high-volume spam campaign delivering malicious Microsoft Word documents that used macros to launch hidden PowerShell and inject malware directly into memory, a fileless-style technique the researchers dubbed PowerSniff. The emails were socially engineered with victim-specific details and were sent about 1,500 times, primarily targeting organizations in the United States, with notable impact on the professional, hospitality, and manufacturing sectors.
The macro abused WMI to spawn a concealed PowerShell process that fetched architecture-specific payloads from rabbitons[.]pw, decoded shellcode, and loaded an embedded payload. The malware then performed anti-analysis checks, host reconnaissance, and victim profiling to avoid healthcare and education targets while prioritizing systems linked to point-of-sale activity and financial transactions; if command-and-control communication succeeded, it decrypted a DLL, saved it under AppData\LocalLow as a randomly named .db file, and executed it through rundll32.exe using the Register export. Researchers said the infrastructure was inactive during analysis and noted behavioral similarities to the Ursnif malware family.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Unit 42 disclosed technical details showing the macro used WMI to spawn hidden PowerShell, downloaded architecture-specific payloads from rabbitons[.]pw, performed anti-analysis and victim profiling, and attempted to retrieve an encrypted DLL from embedded C2 servers. The researchers also noted behavioral similarities to the Ursnif malware family and said no C2 servers were responsive during analysis.
Palo Alto Networks Unit 42 reported a high-threat spam campaign using malicious Microsoft Word documents with macros that launched PowerShell and injected malware directly into memory. The researchers named the malware PowerSniff and said they had observed roughly 1,500 related emails, primarily targeting U.S. organizations.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious email campaign delivered the **MoDi RAT** through a multi-stage, largely fileless infection chain that relied on VBScript, PowerShell, Registry-stored payloads, and process injection. The attack began with an email attachment that triggered HTTP `302` redirects to a OneDrive-hosted ZIP archive, then established persistence with a **Scheduled Task** and stored payload components in the Windows Registry rather than on disk. Sophos reported that some artifacts contained French-language strings and that some of the targeted organizations were French firms. The intrusion used an unusual evasion technique in which a VBS script opened PowerShell and pasted commands into the console through the clipboard and `SendKeys`, reducing the visibility of command-line activity to security tools. PowerShell then extracted and reflectively loaded a .NET decoder from the Registry, unpacked an injector and the final payload, and injected the RAT into `msbuild.exe` without writing the malware to disk. Sophos said **AMSI telemetry** helped detect and block the attack, while noting that AMSI-based protections are available only on newer Windows platforms including **Windows 10** and **Windows Server 2016/2019**.
Aug 14, 2026
Multiple early-2026 campaigns highlight increasingly **low-noise initial access** and **living-off-the-land** execution on Windows endpoints. CyStack reported activity attributed to **APT-Q-27 (GoldenEyeDog)** targeting financial institutions via a corporate support workflow: a user clicked a malicious link delivered through a **Zendesk ticket**, leading to download of an executable masquerading as an image/`.pif` file (aided by Windows’ hidden-extension defaults). The malware was signed with a **revoked certificate** that still appeared trusted due to a valid timestamp, and its modular backdoor/C2 infrastructure overlapped with prior APT-Q-27 activity, enabling stealthy persistence and control without triggering common endpoint alerts. Separately, Securonix described the **Dead#Vax** multistage campaign using phishing links to **VHD files hosted on IPFS**, where mounting/opening the VHD triggers **Windows Script Files**, obfuscated batch, and **PowerShell** loaders to support encrypted data theft and conceal execution logic, culminating in **AsyncRAT** deployment for credential theft, surveillance, and follow-on intrusion. In another targeted operation, Zscaler ThreatLabz linked **Operation Neusploit** to **APT28**, exploiting **CVE-2026-21509** (Microsoft Office/365 **OLE** bypass) via crafted **RTF** documents to drop payloads including **MiniDoor** (Outlook-focused collection and mailbox manipulation, including exfiltration to attacker-controlled email accounts) and **PixyNetLoader** (reported to use steganography). A separate “ThreatsDay” bulletin is a multi-story roundup and does not provide additional, specific corroboration on these same campaigns beyond mentioning adjacent themes (e.g., AsyncRAT/C2) in a broader news digest.
Jun 29, 2026
Cisco Talos reported a targeted phishing campaign that impersonated U.S. Securities and Exchange Commission EDGAR notifications to deliver **DNSMessenger**, a multi-stage malware family that used malicious Microsoft Word documents for initial access. Instead of relying on macros, the lure documents abused **Dynamic Data Exchange (DDE)** to trigger obfuscated PowerShell, reflecting the broader macro-less code execution technique documented by SensePost for Microsoft Word. Talos said the campaign selectively targeted organizations and staged payload delivery through attacker-controlled infrastructure, including a compromised Louisiana state government server. Once executed, DNSMessenger established persistence through multiple mechanisms, including registry **Run** keys, scheduled tasks, alternate data streams, and **WMI** event consumers, before shifting command-and-control traffic into DNS. Talos said the malware used DNS **A** and **TXT** record queries as a covert bidirectional channel to retrieve later-stage payloads, launch `cmd.exe`, and exchange commands and output using structured **SYN**, **MSG**, and **FIN**-style messages. Researchers linked the activity to earlier DNSMessenger operations seen in 2017 and highlighted its obfuscation, fileless PowerShell execution, and selective payloading as signs of a sophisticated intrusion set.
Aug 15, 2026