New Malware Hides Behind Obfuscation and Staged Payloads

A targeted malware campaign against Punjab Safe Cities Authority and PPIC3 in Pakistan leverages spear-phishing with misspelled attachments (malicious Word macro and a malicious ClickOnce-distributed PDF) to deliver multi-stage payloads (code.exe / Adobe.exe). The malware employs VBA stomping, CDN-hosted delivery, Visual Studio Code tunnels for C2, and Discord webhooks for data exfiltration, combining evasion and persistence techniques that resulted in confirmed payload execution and high detection scores.