New Malware Uses Obfuscation and Staged Payload Delivery to Evade Detection

A targeted spear-phishing campaign against Punjab government staff used a misspelled Word document with VBA stomping and a fake Adobe PDF update delivering a custom remote-access payload hosted on BunnyCDN; the malware establishes persistence, exfiltration-capable functionality, and uses Microsoft VS Code tunnels for covert command-and-control and Discord webhooks for attacker notifications, with sandbox and detection telemetry confirming malicious activity.