Don't open that 'copyright infringement' email attachment – it's an infostealer

Rhadamanthys 0.7 is being spread via a global phishing campaign that impersonates legal copyright complaints; recipients receive password-protected ZIPs which, when extracted, present a decoy PDF and an executable that side-loads a DLL containing the infostealer. The variant leverages AI-driven OCR to hunt for cryptocurrency seed phrases and other sensitive data, may deploy MSI files to evade defenses, and targets organizations across multiple countries, indicating an active, financially motivated threat with provided technical writeups and IoCs from multiple security researchers.