Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests

This ASEC analysis details a phishing campaign that uses a malicious XLS exploiting CVE-2017-0199 to fetch an HTA, which executes an obfuscated PowerShell script that downloads a steganographically embedded payload and loads a .NET loader to deploy the Remcos RAT; multiple C2 URLs, domains and MD5 hashes are provided as indicators.