Fake CrowdStrike repair manual pushes new infostealer malware

CrowdStrike warnings detail a phishing campaign that distributes the Daolpu info-stealer via a malicious Word document titled 'New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm' claiming to fix recent CrowdStrike Falcon outages; macros download a base64-encoded DLL dropped to %TMP%\mscorsvc.dll, decoded with certutil, executed to harvest browser credentials and cookies from Chrome, Edge, Firefox and Cốc Cốc, and exfiltrate them to http://172.104.160.126:5000/Uploadss, with CrowdStrike providing YARA rules and remediation guidance.