DarkGate Malware Being Spread Via Excel Docs Attached To Phishing Emails

Cisco Talos researchers report a phishing campaign distributing the DarkGate malware through malicious Excel attachments that exploit Remote Template Injection to fetch and execute payloads. The attackers impersonate CEOs to coerce recipients into opening documents, have shifted to AutoHotKey scripting (from AutoIT) to avoid detection, and are also seen using Microsoft Teams and malvertising as distribution vectors, highlighting active, evolving tactics for information theft and evasion.