Malicious PowerPoint Documents on the Rise

McAfee Labs observed a phishing campaign delivering AgentTesla via malicious PowerPoint .ppam add-ins: when opened the add-in auto-runs VBA that launches mshta and PowerShell to download and execute encoded payloads (agent DLL/EXE), injects via MSBuild, and establishes persistence by creating a scheduled task; the report includes URLs, file and EML hashes as IOCs and provides detection/mitigation guidance including an expert rule and AMSI/DAT coverage.