The Newest Malicious Actor: “Squirrelwaffle” Malicious Doc.

This McAfee blog analyzes the SquirrelWaffle malicious Office document campaign observed from September 2021, describing a phishing-delivered ZIP containing a macro-enabled Word doc that drops an obfuscated VBS; the VBS downloads DLL payloads to C:\ProgramData and executes them via rundll32 (export function 'ldr'), resulting in Cobalt Strike deployment. The report maps techniques to MITRE ATT&CK, provides sample hashes and download URLs, and shows the document’s VBA/UserForm-based code and execution chain used to trick users into enabling macros.