Phishing Campaigns featuring Ursnif Trojan on the Rise

McAfee Labs describes a mass-phishing campaign using malicious Microsoft Word documents with obfuscated VBA macros that extract reversed strings from custom document properties, load and execute shellcode in memory, set an environment variable containing a URL, download an Ursnif DLL to a temporary file, and execute it via rundll32; the report includes static macro analysis, IOCs (file hashes and download URL), detection names, and MITRE ATT&CK mappings.