Analysis of a Dridex Banking Trojan Phish

This report details phishing campaigns exploiting COVID‑19 relief themes to deliver the Dridex banking trojan via macro-enabled documents and credential-harvesting sites that spoof Microsoft login pages; the author demonstrates an active compromise where entered credentials were stored on an exposed attacker server and provides detection and prevention advice (email red flags, WMI/PowerShell monitoring, and WatchGuard products).