Emotet coming in hot
Summary: Cisco Talos observed increased Emotet spam activity beginning in early November 2022, distributing zip files containing XLS documents or XLS attachments directly, with most maldocs timestamped from early November. The campaign uses Auto_Open macros and a fake security-policy message that convinces victims to copy the document to a folder without macro protections, after which a VBA macro assembles a download URL from hidden sheets and drops the payload into C:\Window\System32.
What you should know: Emotet is betting that a convincing social-engineering prompt will defeat Microsoft's default macro blocking, so the control you just enabled depends on users ignoring an instruction that looks like official security policy.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026