Emotet adds a further layer of camouflage

This report describes Emotet’s continued evolution from a banking Trojan into a highly distributed, modular malware service: researchers observed ~47,000 infected hosts emitting ~6,000 distinct malicious URLs (about 45% of observed distribution URLs), and noted recent evasive advances including RFC-compliant HTTP headers that mimic legitimate traffic and randomized URIs—changes that reduce the effectiveness of static network signatures and increase detection difficulty.