The only thing worse than being fired is scammers fooling you into thinking you're fired

**Executive summary:** A financially motivated phishing campaign impersonates employment-termination tribunal notices and lures Windows users to a fake Microsoft site where a RAR archive contains a malicious VBScript (e.g., "Processo Trabalhista.vbs") that downloads a Base64-encoded payload and deploys additional malware, including the Ponteiro banking trojan and other infostealers; Cloudflare observed the campaign across multiple sectors and attributes the activity to a likely single actor using several sender addresses.