Hackers Using Sneaky HTML Smuggling to Deliver Malware via Fake Google Sites

Cybersecurity researchers observed a widespread phishing campaign abusing Google Sites and HTML smuggling to distribute the AZORult information stealer (with a later analysis reattributing the payload to Koi Loader/Koi Stealer). The attack uses CAPTCHA-protected fake Google Docs pages to deliver LNK files disguised as PDF bank statements, which trigger PowerShell and batch script chains that fetch and execute loaders and the stealer via reflective, fileless techniques and AMSI bypass, aiming to harvest credentials, browser data, documents and cryptocurrency wallets.