Phishing campaigns using valid domains and newsletter-bounceback reply addresses to slip past reputational checks, delivering obfuscated Word macro droppers that exploit Office CVE-2017-0199.

Following a SWIFT-themed spam email to a Box-hosted downloader scoring 0 of 63 on VirusTotal, and the evasion tactics that kept it there.

Why spammers attach malware to resumes: hiring managers and HR open them by default, and entire campaigns are built on that certainty.