Beware of phishing emails disguised as quote requests

AhnLab ASEC reports a phishing campaign delivering a multi-stage malware chain: a RAR attachment contains VBScript that reconstructs an obfuscated PowerShell command (using token substitution) to fetch a staged payload from attacker-controlled Google Drive links. The downloaded file is split into loader, payload, and a secondary PowerShell stage stored under %APPDATA%\Maleic.For; the secondary PowerShell escalates privileges via ShellWindows/Explorer, executes an in-memory loader that XOR-decrypts the payload, and the payload fetches and injects Remcos RAT into MicrosoftEdgeUpdate.exe. The report provides C2 URLs, an MD5, substitution rules, payload offsets, and defensive guidance for email verification and attachment/link handling.