Trusted Design

Evoltin POS Malware Attacks via Macro

概要

Over the past couple of months McAfee Labs has seen an increase in the usage of macros to deliver malware. This kind of malware, as mentioned in previous posts (Dridex, Bartallex), usually arrives as an attached document within a phishing email. Recently McAfee labs came across a point-of-sale (POS) malware that spreads through malicious macros inside a doc file. This macro comes into users’ systems through a spam email with subjects such as "My Resume," "Openings," Internship," etc. and an attached Microsoft Word file, some with names like these:

Created: 2026-02-23

Indicators

• FileHash-MD5 - 6cdd93dcb1c54a4e2b036d2e13b51216 -
• domain - infofinaciale8h.ru -
• domain - helpdesk7r.ru -
• domain - systeminfou48.ru -

類似Pulses

• Enterprises Hit by BARTALEX Macro Malware (score: 0.80)
• Phishing Email Serving W97M/Dropper.cu via Office Doc with Macro (score: 0.71)
• Dyre Botnet Using Malicious Microsoft Word Macros (score: 0.69)
• Malicious Office files dropping Kasidet and Dridex (score: 0.68)
• Malicious macro using a sneaky new trick (score: 0.68)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る