APT28 Targeted European Entities Using Webhook-Based Macro Malware

**Executive summary:** Russia-linked APT28 conducted "Operation MacroMaze" (Sep 2025–Jan 2026), delivering spear-phishing Word documents that beacon to webhook.site via the INCLUDEPICTURE field and execute macros that run VBS/CMD/batch chains to render Base64 HTML in Microsoft Edge (headless or moved off-screen) to retrieve commands, execute them, and exfiltrate output back to webhook endpoints; the campaign emphasizes stealth using simple tooling, artifact cleanup, and widely used webhook services for payload delivery and data exfiltration.