From Malspam to Fileless .NET Loader

Reported 09 Jun 2026 by otx · Severity: medium

A sophisticated malspam campaign delivers a multi-stage .NET loader through an elaborate chain beginning with HTML email attachments. The attack routes through legitimate Google DoubleClick infrastructure to evade detection, then deploys a dynamically personalized phishing kit th