JavaScript Malspam Campaigns

Zscaler ThreatLabZ reports ongoing malspam campaigns delivering heavily obfuscated JavaScript masquerading as invoices/receipts; when users allow script execution (ActiveX), the scripts fetch and execute malware payloads (observed Kasidet and Emotet variants) from hardcoded URLs. The report analyzes the obfuscation and deobfuscation steps, infection chain, and notes widespread distribution (10,000+ instances over two weeks), advising caution with email links and layered defenses.