Malspam Campaigns Use Malicious RTF Documents

Zscaler ThreatLabZ documents a phishing-driven campaign that uses malicious RTF files exploiting CVE-2017-8570 and CVE-2018-0802 to drop and execute LokiBot payloads; the report details exploit mechanics (Packager.dll, composite monikers, equation editor overflow), LokiBot persistence and information-stealing capabilities, artifacts and IOCs (MD5 hashes, domains, IPs, paths), and recommended detections/protections.