Independence Day greeting campaign delivers Emotet

**Executive Summary:** Zscaler ThreatLabZ observed an active Emotet campaign (July 2–4) distributing malicious Microsoft Office "Greeting Card" attachments that prompt users to enable macros; an obfuscated VBA macro launches a heavily obfuscated PowerShell payload downloader which installs Emotet (copies to system32, creates mutex PEM). The report includes de-obfuscation details, attack TTPs, and comprehensive IOCs: document and executable MD5s, download URLs/domains, and numerous C2 IP addresses.