A fake invoice email delivers ZLoader hidden in an Excel document. (Source: Forcepoint)
A new phishing campaign distributes ZLoader malware using advanced delivery techniques that demonstrate sophisticated understanding of Microsoft Office document formats and techniques, the security firm Forcepoint X-Labs reports.
The phishing emails use an invoicing lure, but the message varies, perhaps dealing with a bill already processed or describing new taxation rules from the Internal Revenue Service, the researchers say.
If the phishing victims enable macros in a Microsoft Word attachment, they trigger the download of an encrypted Excel sheet in which the final malware payload is hidden, Forcepoint X-Labs researchers say in their new report.