Threat Actors Exploit Commodity Loader in Targeted Email Campaigns Against Organizations

Cyble Research and Intelligence Labs reports a coordinated, multi-stage email campaign leveraging weaponized Office docs, malicious SVGs, and steganographically stored payloads to deliver a shared commodity loader that deploys multiple RATs and infostealers (notably PureLog Stealer) against manufacturing and government targets in Italy, Finland, and Saudi Arabia, employing advanced evasion techniques (obfuscation, trojanized .NET assemblies, process hollowing, and a novel UAC bypass).