DBatLoader Leverages OneDrive to Deliver Commodity Malware

Researchers have observed almost two dozen email campaigns since late June that use a combination of a known malware loader, lures related to shipping orders and purchase requests, and various legitimate services like OneDrive, in order to deliver an array of commodity malware families.

The loader malware, DBatLoader, has been in use since 2020, and has been used in malspam campaigns to deliver various RATs and infostealers. In these latest campaigns, the malware used several new techniques to deploy Remcos, …

array campaigns commodity malware dbatloader email june loader malware onedrive order requests researchers services shipping