New Phishing Attack Uses Clever Microsoft Office Trick to Deploy NetSupport RAT

Perception Point reports on Operation PhantomBlu, a U.S.-targeted phishing campaign that uses password-protected Word docs and OLE template injection to deliver NetSupport RAT via a ZIP containing a shortcut (.lnk) PowerShell dropper; attackers send messages through the Brevo email platform and increasingly host malicious payloads/URLs on abused cloud, CDN and Web3 services to evade detection.