The Qakbot emails show the long tail of exploitation efforts against the Microsoft ProxyLogon flaw.
Researchers have observed attackers leveraging email thread hijacking tactics to spread the Qakbot malware, which in turn deploys multiple payloads.
Threat actors are attempting to gain the trust of victims by pretending to be a potential customer and filling out an online contact form before launching the BazarLoader attack.
Microsoft is blocking macros by default for Office, which it hopes will make abuse by cybercriminals more difficult.
Crane Hassold, with Abnormal Security, recently joined Lindsey O’Donnell-Welch on the Decipher podcast to talk about why business email compromise attacks are still a top financially damaging threat today.