Bumblebee malware attacks are back after 4-month break

Proofpoint observed a large-scale phishing campaign delivering the Bumblebee malware loader via voicemail-themed emails that link to OneDrive-hosted macro-enabled Word documents; the macros create a script that runs a PowerShell chain to fetch and execute the Bumblebee DLL (w_ver.dll), enabling follow-on payloads like Cobalt Strike and potential ransomware deployments.