Attack chain leads to XWORM and AGENTTESLA

This report describes an active malware campaign using weaponized Word/RTF documents that download obfuscated PowerShell and a custom .NET loader to memory-load XWORM and AgentTesla; the actors use AMSI bypasses, scheduled tasks, persistence under C:\ProgramData\MinMinons, process hollowing into signed .NET binaries, and a Discord webhook for exfiltration, with several hosted URLs and YARA detection rules provided as IOCs.