When A Pony Walks Out Of A Pub
Summary: Cisco Talos observed a small email campaign using Microsoft Publisher (.pub) files to deliver the Pony credential-harvesting malware, marking the first known use of the .pub format for this purpose. The .pub attachment carries a 2MB+ macro that writes a 430K obfuscated 'letten.js' file to disk, which then downloads a binary from hxxp://5.200.52.198/flex/3435dde3r.exe to the TEMP folder, renames it kl.pub, and executes it.
What's compelling: Microsoft Publisher ships by default in Office 365 and lacks the Protected View mode that guards other Office applications, so a file format most users never think about can run a macro and pull down Pony without that safety net. Pony's leaked source means multiple actors can drop this credential harvester into their own infection chains, and it is also commonly used as a loader for additional malware.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026