The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP

Reported 03 Jun 2026 by otx · Severity: medium

Cybercriminals in Brazil are exploiting the country's electronic invoice system (Nota Fiscal eletrônica) to deliver Havoc framework implants. The campaign surfaced during May 2026, coinciding with tax season when accountants routinely process invoice-related emails. Attackers dis