New Ursnif Campaign: From PowerShell to Mshta

**Ursnif multistage distribution (Mar 24, 2020):** Zscaler ThreatLabz analyzed a live campaign delivering the Ursnif banking trojan via a three-stage chain (malicious DOC macro -> obfuscated HTA executed by mshta -> index.dll downloaded and executed via regsvr32). The report documents the VBA/HTML/JavaScript payload behavior, decoded payload URL, newly registered domains, payload URLs, a download link and an MD5 hash for the payload.