The 'Clean' .docx That Was an Encrypted Office Package

The report documents a high-severity spearphishing campaign that delivered a password-encrypted OLE2 Office attachment (EncryptionInfo + EncryptedPackage) misdeclared as a .docx; the decryption code (8523) was printed in the message body, allowing the attacker to bypass automated inspection. Analysis highlights scanner-evasion, multiple IOCs (file magic, CFB streams, gibberish X-Mailer and HELO, QQ read-receipt headers, unreachable original host), and urges treating encrypted attachments with embedded passwords and message-level context as detection conditions.