'Fluffy Wolf' Spreads Meta Stealer in Corporate Phishing Campaign

Bi.Zone researchers report an active phishing campaign by an actor called Fluffy Wolf that impersonates a construction company to send password-protected accounting report attachments; when opened these lures deploy Remote Utilities to fetch Meta Stealer and other payloads (WarZone RAT, XMRig, and legitimate tools). The actor, active since 2022, has carried out at least ~140 attacks primarily against Russian organizations, leveraging low-skill access to malware-as-a-service and legitimate remote-access tools to exfiltrate credentials, cookies, FTP data, VPN and crypto wallet information; the report includes IoCs and MITRE ATT&CK mappings and recommends managed email security and threat intelligence monitoring.