Attackers are using Word documents with malicious macros and PowerShell to infect computers with fileless malware, researchers warn
By Lucian Constantin Mar 14, 2016
Spammed Word documents with malicious macros have become a popular method of infecting computers over the past few months. Attackers are now taking it one step further by using such documents to deliver fileless malware that gets loaded directly in the computer's memory.
Security researchers from Palo Alto Networks analyzed a recent attack campaign that pushed spam emails with malicious Word documents to business email addresses from the U.S., Canada and Europe.
The emails contained the recipients' names as well as specific information about the companies they worked for, which is not typical of widespread spam campaigns. This attention to detail lent more credibility to spam messages and made it more likely that victims would open the attached documents, the researchers said.
The documents contained macros that, if allowed to run, execute a hidden instance of powershell.exe with special command-line arguments. Windows PowerShell is a task automation and configuration management framework that's included in Windows by default and comes with its own scripting language.
Full Article
