Office Scripts extract Excel hyperlink URLs without macros; results are hardcoded so the file can stay .xlsx, reuse is straightforward.

APT28’s Operation MacroMaze used macro-laced documents and webhook.site to exfiltrate data across Europe from Sept 2025 to Jan 2026.

UnsolicitedBooker targets Central Asian telecoms with LuciDoor and MarsSnake, while PseudoSticky and Cloud Atlas hit Russia.

A sophisticated Python-based malware deployment uncovered during a fraud investigation has revealed a layered attack ...