The second in today’s Lokibot campaigns hitting UK is more normal than the earlier one. However it still has a few stings and misdirections to try to confuse you. An email pretending to be a delivery notification with the subject of Re: SM-192C6 INSTEAD SM-122C7 pretending to come from sales@sktoy.com with a malicious word doc RTF attachment delivers Lokibot,. This was actually spammed out concurrently with the first campaign but was caught in quarantine where I have just found time to investigate it. They are using email addresses and subjects that will scare or entice a user to read the email and open … Continue reading →