Top Reads: April 2023

This ReliaQuest roundup documents three active threats: Emotet re-emerging via OneNote-embedded WSF/VBS to sidestep Office macro protections and deploy DLL payloads, the proliferation of Phishing-as-a-Service operations (including an AiTM kit that steals authentication cookies to bypass MFA), and a review of common MFA bypass techniques (SIM swaps, channel hijacking, OTP/real-time phishing). The report highlights operational impacts, examples of attacker tooling and OPSEC failures, and recommends mitigations such as blocking risky file types, stronger email filtering, MFA app use, phishing training, and network controls.