PurpleFox Returns: Insights On Its Recent Spam Campaign

Cyble Research and Intelligence Labs analyzed a spam campaign that distributes PurpleFox: malicious Word attachments trigger VBA macros which download a PowerShell 'jpg' downloader that fetches a PNG containing a second-stage PowerShell script via steganography; that script disables protections and repeatedly installs an MSI (disguised as a JPG) that drops and sideloads PurpleFox DLLs. The report includes technical analysis, MITRE ATT&CK technique mappings, and IOCs (file hashes, URLs, and domain) to aid detection and response.