Ankura CTIX FLASH Update - December 3, 2024

Connecting Busy IT and Business Leaders to the Most Important Cyber News and Threats twice-weekly

The Ankura FLASH Update is prepared by the Cyber Threat Investigations and Expert Services (CTIX) team to provide timely and relevant cyber intelligence pertaining to current or emerging cyber events.

Malware Activity

Phishing Attacks Use Corrupted MS Word Documents to Evade Prevention

Attackers are attaching corrupted Microsoft Word documents to phishing emails in a novel attempt to evade email malware prevention mechanisms. Corrupted Word documents bypass email security due to their damaged state but can still be recoverable by Microsoft Word when opened. New phishing campaigns attach these corrupted documents to emails purporting to be sent from an organization's payroll or HR department announcing information about benefits or bonuses. When the attachment is opened, Microsoft Word will build the document if the user clicks "Yes" to attempt recovery when