Recent Emotet Spam Campaign Utilizing New Tactics

Emotet has resumed activity and is distributing payloads through malicious OneNote attachments that embed obfuscated WSF scripts; when users interact with a fake OneNote page the script drops a .wsf file which downloads a DLL payload (size-checked) and executes it via regsvr32, establishing C2 communications. The report provides technical details of the delivery chain, deobfuscation, sample hashes, known payload URLs, MITRE ATT&CK mappings, and defensive recommendations.