Jasper Loader Emerges, Targets Italy with Gootkit Banking Trojan
Summary: Cisco Talos is tracking a loader called JasperLoader, distributed through signed-email spam campaigns focused on central Europe, particularly Germany and Italy, that ultimately delivers the Gootkit banking trojan. The Italy campaigns abuse the legitimate Posta Elettronica Certificata (PEC) certified email service tied to Italy's 2019 electronic invoicing law, attaching EML files that carry ZIP archives with DOCM files containing malicious VBA macros.
Key Takeaway: Attackers are borrowing the trust of a government-mandated certified email service and valid message signing to get victims to open attachments, and Talos found 167 unique malicious DOCM files sharing the 'VPS2day' metadata string in VirusTotal alone.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026