Phishing targeting Polish SMBs continues via ModiLoader

ESET detected nine ModiLoader-based phishing campaigns in May 2024 targeting SMBs (primarily in Poland) that used spearphishing attachments (ISO/RAR with obfuscated scripts) to deploy ModiLoader, which retrieved Agent Tesla, Formbook, or Rescoms; attackers relied on compromised email accounts and servers and hosted payloads on OneDrive or hacked infrastructure, and the report includes IoCs and MITRE ATT&CK mappings.